78d8ebc78166608c44ca7c3d06cc88fc5b420366c2071e416737eac0cc3b2127

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 14:17

Target

78d8ebc78166608c44ca7c3d06cc88fc5b420366c2071e416737eac0cc3b2127.dll
Size

146KB
MD5

f17773c457472898cf136ab38b8e297a
SHA1

1d0e41fae449a2c2190ae1c70415448db9dad143
SHA256

78d8ebc78166608c44ca7c3d06cc88fc5b420366c2071e416737eac0cc3b2127
SHA512

ad2abefbd651bcdbf7f081402a31e1e07c956346620786601d7b4b8e822e8b5b904b08d7cb7b4459118e9beecb99c191ca9fa786bae94defd848495db0b0f298
SSDEEP

3072:BKfrgplmGvuUv64TToNS/NLw5+FRdOwIzP3251tshQbeMLs8:uqmGvz64oIG5+ZOh/UshC9

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4712-0-0x0000000075850000-0x00000000758A2000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 4712	5100	rundll32.exe	78
PID 5100 wrote to memory of 4712	5100	rundll32.exe	78
PID 5100 wrote to memory of 4712	5100	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\78d8ebc78166608c44ca7c3d06cc88fc5b420366c2071e416737eac0cc3b2127.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\78d8ebc78166608c44ca7c3d06cc88fc5b420366c2071e416737eac0cc3b2127.dll,#1
  2⤵
  PID:4712

memory/4712-0-0x0000000075850000-0x00000000758A2000-memory.dmp

Filesize
328KB

Download