cbe8bec689fc989f522ce95716bc7eacc85cfba7117b348c257130fab6fef317

Analysis

max time kernel
139s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2024 08:04

Target

$SYSDIR/avisynth.dll
Size

301KB
MD5

fec24e7beedf0d4f44b9832bfae12c2a
SHA1

8621cc1f3eec932f55dc84dd3df7f0ed91cfe0a4
SHA256

2321505dc63367ef14fa66f0d72253a0c506e31c243dcfc34439dd09d26be599
SHA512

7c4b132af6be0ae901b861403b4c0826da353874826fd17e1d97b0977c5a3b80131d0ddd40a1758ae6b1e40c80577998e2ff05379e9887cbe808a429077427eb
SSDEEP

6144:CCQWKr6y+pYLxY1WAgAzxS3SNYFERwqB/XvlVIxv383U0iMdvGYZ2g5dC4IHUoGM:Grd+uFEU3SNiwwqB/vlC83U9MdnzKvGM

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral10/memory/2300-0-0x0000000010000000-0x0000000010106000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2300	2296	rundll32.exe	84
PID 2296 wrote to memory of 2300	2296	rundll32.exe	84
PID 2296 wrote to memory of 2300	2296	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\avisynth.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\avisynth.dll,#1
  2⤵
  PID:2300

memory/2300-0-0x0000000010000000-0x0000000010106000-memory.dmp

Filesize
1.0MB

Download
memory/2300-1-0x0000000002110000-0x0000000002277000-memory.dmp

Filesize
1.4MB

Download