40d4bc677804c8b7cbd4f13942682658546aee56746fecbd59e5eeef7da46c5f

Analysis

max time kernel
91s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 01:14

Target

Languages/French.dll
Size

42KB
MD5

82e6695938aba9196aa9a08fbdcc42e4
SHA1

dc2bc2ce61e99e7addd6dbd329122c3b33435d44
SHA256

95df6ef844ffd9e7b6f616c781c25ca1cbdd63d448e8dafea106b61f31869331
SHA512

089f3caecd7e7a20ce4758d092367dbcd4235f0d2c1691e96a7369a55128ad47dc4144ce96bf7fe4981bd8c761a6ac84713852f8bab45b42649b5f7c1e5f805e
SSDEEP

768:9d+bx579V7p+5yAlVXxv9j2WeRVl7/36YS4urxHD77XDhgRSxZvDj4Vykv:9YPJ7s/lcvp7iYNutj77XYqZP4Vyk

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral6/memory/1904-0-0x0000000010000000-0x000000001002D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 1904	4572	rundll32.exe	80
PID 4572 wrote to memory of 1904	4572	rundll32.exe	80
PID 4572 wrote to memory of 1904	4572	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Languages\French.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Languages\French.dll,#1
  2⤵
  PID:1904

memory/1904-0-0x0000000010000000-0x000000001002D000-memory.dmp

Filesize
180KB

Download