6b7eace348b11fc8fb50a6e40492839972dfda5853ed83d86f73c9017af01089

Analysis

max time kernel
141s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 13:40

Target

$TEMP/SDM143/ExentCtlInstaller.dll
Size

94KB
MD5

b7ad06c57419ed74fff4872b8693c353
SHA1

753e6a6f55503ff14f243e07c80915df445d8efa
SHA256

fa4601e6048ca661536882e91e9756526de719c5db298f5481f892c121200a66
SHA512

838c9211fef9de1706409b8304ed43236d4b3dbfa551c56d51f15c4c31e18a2a7f64722ef4c6c291768ecf7ca40d9ae1ec08f3afab4979323a66caeb3452aa8f
SSDEEP

1536:JyrB9NViYoJ3w1NjSzF5yfBsiZpsVI2TFQblrjgZYBmmlNL9bnouy8/:o9eS3sF5EsuyQgp2out/

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral10/memory/4852-0-0x0000000010000000-0x0000000010063000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 4852	2992	rundll32.exe	83
PID 2992 wrote to memory of 4852	2992	rundll32.exe	83
PID 2992 wrote to memory of 4852	2992	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\ExentCtlInstaller.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\ExentCtlInstaller.dll,#1
  2⤵
  PID:4852

memory/4852-0-0x0000000010000000-0x0000000010063000-memory.dmp

Filesize
396KB

Download