4b04bc91719f8d04209ef9f520fc2cb27e863574fd1f1f9ca95c8c1fef51a9e7

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 16:23

Target

$TEMP/SDM143/resourceDll.dll
Size

171KB
MD5

5cf0fba9e8775382233c8e63e52c838a
SHA1

b2a092f71eff0f6916652d7f3bfde9204eda5636
SHA256

7d940af8950b106227539cd4bdfb62f2d37a4abeaf568ebe2275fd31058c2ca5
SHA512

73489e3638b98ffd7bd516bfed519cfd48758aaaedc11cb202d11822cad609caf9af95e9e864bd8a992be826945e6d018ce081f3970511fd49d7757ca6affd25
SSDEEP

3072:+ZY/h+iA4GaJfGZK2MiMq5dpNQA2Wj5vg/ySQGdXMd86a30GCooutkzjO:YWwqGaJfGZ1Mq5BRj2/yR8XMZ0CooSkz

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral18/memory/996-0-0x0000000010000000-0x000000001009F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 996	1592	rundll32.exe	82
PID 1592 wrote to memory of 996	1592	rundll32.exe	82
PID 1592 wrote to memory of 996	1592	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\resourceDll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\resourceDll.dll,#1
  2⤵
  PID:996

memory/996-0-0x0000000010000000-0x000000001009F000-memory.dmp

Filesize
636KB

Download