9990a8d638476fa95989232f9bea2c6807e5e9551a33f4d98c4adcaac646f665

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 21:23

Target

$TEMP/SDM143/resourceDll.dll
Size

171KB
MD5

5cf0fba9e8775382233c8e63e52c838a
SHA1

b2a092f71eff0f6916652d7f3bfde9204eda5636
SHA256

7d940af8950b106227539cd4bdfb62f2d37a4abeaf568ebe2275fd31058c2ca5
SHA512

73489e3638b98ffd7bd516bfed519cfd48758aaaedc11cb202d11822cad609caf9af95e9e864bd8a992be826945e6d018ce081f3970511fd49d7757ca6affd25
SSDEEP

3072:+ZY/h+iA4GaJfGZK2MiMq5dpNQA2Wj5vg/ySQGdXMd86a30GCooutkzjO:YWwqGaJfGZ1Mq5BRj2/yR8XMZ0CooSkz

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral18/memory/1048-0-0x0000000010000000-0x000000001009F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3452 wrote to memory of 1048	3452	rundll32.exe	rundll32.exe
PID 3452 wrote to memory of 1048	3452	rundll32.exe	rundll32.exe
PID 3452 wrote to memory of 1048	3452	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\resourceDll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\resourceDll.dll,#1
  2⤵
  PID:1048

memory/1048-0-0x0000000010000000-0x000000001009F000-memory.dmp

Filesize
636KB

Download