d21665dfe3585e46c95bfe5ba45495e8ceccce3e2bc92fd993bbfaa011a216a5

Analysis

max time kernel
66s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 18:54

Target

I386/SYSTEM32/DISKCOPY.dll
Size

558KB
MD5

812e9e7b3e4ad78b538b1f5ef15156a6
SHA1

aab05c291994bac410325fd711b8f48e2f374d02
SHA256

3ebcff029a63fa9394f5ba7e18a7d78a9c7d6db5c596f2b7e08284b2aa584a69
SHA512

a6d2359defbde2014e3a56d2107b8eff4bafad3badddde29f65178e4eebf6e54d3ce0e937c216918cffc84944d101500ba710ceb277c73d266d37902a8806283
SSDEEP

12288:0x7e1DS/WTPRwNza8x7Qx4+xhewCOf3t/2nyS31F6QBlo6qj:qQS/WTPRwVa0yUXOf3tMyMD6ilXqj

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral20/memory/5048-0-0x000000006CC70000-0x000000006CDE5000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 5048	3760	rundll32.exe	85
PID 3760 wrote to memory of 5048	3760	rundll32.exe	85
PID 3760 wrote to memory of 5048	3760	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\I386\SYSTEM32\DISKCOPY.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\I386\SYSTEM32\DISKCOPY.dll,#1
  2⤵
  PID:5048

memory/5048-0-0x000000006CC70000-0x000000006CDE5000-memory.dmp

Filesize
1.5MB

Download