da8e170fcf92b7f4a7ccfadcc265341b1261559a2e97814eebd62114b74ea430

Analysis

max time kernel
93s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 09:36

Target

da8e170fcf92b7f4a7ccfadcc265341b1261559a2e97814eebd62114b74ea430.dll
Size

1.9MB
MD5

6dd6c7003e4fae8cf1aaab51ce18898c
SHA1

4a2f090e5015646c2926bd3325f472aa13960199
SHA256

da8e170fcf92b7f4a7ccfadcc265341b1261559a2e97814eebd62114b74ea430
SHA512

14c3c082f93cd1e856f947c9500cf08a49f361cad55066775de1863e3fb906d28adec0ec9ece343572a439fe2628987b050feec80856bdfd5f23c064b6061dda
SSDEEP

49152:iNgjNMLuFlXfwLsiXTf5dCJMnIvEXw1+B9FoR/nLAUGBJ:7jNMLuFlX4LPTffCJMnikB9FoR/U

Score

8^/10

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\RtsUpx.sys	rundll32.exe
File opened for modification	C:\Windows\system32\drivers\RtsUpx.sys	rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 3876	3688	rundll32.exe	83
PID 3688 wrote to memory of 3876	3688	rundll32.exe	83
PID 3688 wrote to memory of 3876	3688	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\da8e170fcf92b7f4a7ccfadcc265341b1261559a2e97814eebd62114b74ea430.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\da8e170fcf92b7f4a7ccfadcc265341b1261559a2e97814eebd62114b74ea430.dll,#1
  2⤵
  - Drops file in Drivers directory
  PID:3876

C:\Users\Admin\AppData\Local\Temp\RtsUpx896.sys

Filesize
29KB

MD5
0cb2a8c4ec48ca097340afe0ca57d91d

SHA1
8c89ba50e3e84345f44f82b9f8c5a60a347a67c4

SHA256
f48d5204d02a2801120d3a2c849b0f0f13cf3d9fac4c2392fbbcb7710506621e

SHA512
d45d19230f171e7dea0a5518cfda69a1d6070f7e0a1ab88d622e0772b3d7a8dce314b8927a033aeb16423d758a0bcb5a3a2bfa31a09a7f201eb7088bf2a208f9

Download Submit