eaf93deafb8967bb508594d5ec14ce6c01f2f276e9591cb3b6a5c34e2afc7d9c

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 02:41

Target
eaf93deafb8967bb508594d5ec14ce6c01f2f276e9591cb3b6a5c34e2afc7d9c.dll
Size 29KB
Sample240507-c6f4tahe66
SHA256 eaf93deafb8967bb508594d5ec14ce6c01f2f276e9591cb3b6a5c34e2afc7d9c
MD5 80533dea621a3e56b8b4c41227f5e7c4
SHA1 7fe7b19382330ce8201a49c9aac1db439c11a7b1
SHA512 73b3b9ed140afb06c88bfe0ac8c38e98bf13ef772a754115a67100264edb2c96c70f3d6906740372e061cadf7b591b86183e10b5a480e43d22e7dd38ee6a134e
SSDEEP 768:fJJeaauQDtYsr19Y4WhIhYg7ZpRfLNFNN:fbeVjDSsrbeITRfBF
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

upx

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/memory/1104-0-0x0000000010000000-0x0000000010016000-memory.dmp	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1104-0-0x0000000010000000-0x0000000010016000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1104	1600	rundll32.exe	91
PID 1600 wrote to memory of 1104	1600	rundll32.exe	91
PID 1600 wrote to memory of 1104	1600	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\eaf93deafb8967bb508594d5ec14ce6c01f2f276e9591cb3b6a5c34e2afc7d9c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\eaf93deafb8967bb508594d5ec14ce6c01f2f276e9591cb3b6a5c34e2afc7d9c.dll,#1
  2⤵
  PID:1104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:4688

memory/1104-0-0x0000000010000000-0x0000000010016000-memory.dmp

Download