d21665dfe3585e46c95bfe5ba45495e8ceccce3e2bc92fd993bbfaa011a216a5

Analysis

max time kernel
144s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 18:54

Target

I386/SYSTEM32/DNSAPI.dll
Size

77KB
MD5

035672a7257fc6066d9a34d04d3f0c07
SHA1

72120b1493d4c98d818c8075673b64ae98ddff9f
SHA256

d84036c1c61066b212ca28428269b4b416e2e8802f53d79c628a7ca9b1ba4399
SHA512

9e328506a2449fe0fdda219a3c2287a61122c0d595e554ba9c93b88c9b5dbf939131fc01b7d67e2a021b20d7ad89aae914d06be70833fbf310c2b0bbb70c661b
SSDEEP

1536:Iy76qQa6+UYXIjS8EVjp67CJTzueKit6lmWFKfjbE+nxI+k/PVOn:IUzQt+YjS8EVkGPKw6lmWsE+xGPV

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral21/memory/496-0-0x00000000006F0000-0x000000000071C000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 496	2964	rundll32.exe	89
PID 2964 wrote to memory of 496	2964	rundll32.exe	89
PID 2964 wrote to memory of 496	2964	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\I386\SYSTEM32\DNSAPI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\I386\SYSTEM32\DNSAPI.dll,#1
  2⤵
  PID:496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3932 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:3404

memory/496-0-0x00000000006F0000-0x000000000071C000-memory.dmp

Filesize
176KB

Download