758aa225793851ddbc032d77824473ea9b0f6dee46b36b95a7f66010e472586f

Analysis

max time kernel
131s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 01:17

Target

758aa225793851ddbc032d77824473ea9b0f6dee46b36b95a7f66010e472586f.dll
Size

130KB
MD5

d22ae4d885cf1929e3e90f72484610b0
SHA1

b50d4d1e0d8c129287774064225e95e896fb51bf
SHA256

758aa225793851ddbc032d77824473ea9b0f6dee46b36b95a7f66010e472586f
SHA512

8504e4da9b45b83b20dbb88514065581203cf74340bff30f4ca495320f69ae556a87858fdc57ad434af7c5e8d82a9527e0357b152a6ef3931db3b36499f710f8
SSDEEP

3072:TgYb22tVOGS+70DuaqXOr614/UX7gUKKipbGY7lK8OaWSXqout:G2aGSXuaqXOr614/Cg/kY7GaWuqoS

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/4388-0-0x0000000010000000-0x00000000100B3000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 860 wrote to memory of 4388	860	rundll32.exe	rundll32.exe
PID 860 wrote to memory of 4388	860	rundll32.exe	rundll32.exe
PID 860 wrote to memory of 4388	860	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\758aa225793851ddbc032d77824473ea9b0f6dee46b36b95a7f66010e472586f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\758aa225793851ddbc032d77824473ea9b0f6dee46b36b95a7f66010e472586f.dll,#1
  2⤵
  PID:4388

memory/4388-0-0x0000000010000000-0x00000000100B3000-memory.dmp

Filesize
716KB

Download