8380b8aac0e4c16f62709ea1673b85be3d604eaffb0279277e7bb37a78dea3c8

Analysis

max time kernel
129s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 08:28

Target
Mensagem de voz.mp3.dll
Size 204KB
Sample240603-kda14aad46
SHA256 5ae3b774165e93198a45af01c3950e957028596b3abb2177fbd54b52c79c43da
MD5 d7dd8961b5af364f6a08638dae98f958
SHA1 fe40eb9edc9dc80fccc5e56b4dc873453ff4fec1
SHA512 3aa33bf06a321eb7fa30c650f6119702fe13004479f5fcfbe6266b19d640cf54c33b4abcd1537224e154115f06986875c944814544faa39ac8c0688033df1954
SSDEEP 6144:zUytxlQmVp8Qh5cZ5gDUErlUmldW+LG8lTW:wyt7QmD8gcPguA7Jl
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2280-1-0x0000000001F90000-0x000000000201D000-memory.dmp	upx
behavioral2/memory/2280-0-0x0000000001F90000-0x000000000201D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2280	2328	rundll32.exe	83
PID 2328 wrote to memory of 2280	2328	rundll32.exe	83
PID 2328 wrote to memory of 2280	2328	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Mensagem de voz.mp3.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Mensagem de voz.mp3.dll",#1
  2⤵
  PID:2280

memory/2280-1-0x0000000001F90000-0x000000000201D000-memory.dmp

Download

memory/2280-0-0x0000000001F90000-0x000000000201D000-memory.dmp

Download