d4164b1dab1337e28d3ce097a32b8635c893e1acaaf7136e745b90c44ee2cf05

Analysis

max time kernel
146s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 02:26

Target

htmlayout.dll
Size

681KB
MD5

cffe21f7cfe677eec54b8d8020ef0690
SHA1

580b995f8d370d25cbfeb5dc633f6eec68e7cafb
SHA256

9cf74cd193f4fb530c530d4f9feff9ec81a24a5c5922998101657128de771b0c
SHA512

a74bd3b8ad64ea6bd56aafcc71eac85f47ea164b025e8f700177f53a9d37ad2ce718dd265c93e525ef6bff06d7ac39e4e2a8337a55ca668a665313eb1ae01dd2
SSDEEP

12288:gLugumxc7DzzM1POf+8WmysE5SgQ11D3XVUuK8bFe+airYt/IOsyuW+dvL:gKge7PJf+8Fys6Q11D3XVULm4+aisSOc

Score

9^/10

UPX dump on OEP (original entry point) 1 IoCs

Processes:

resource yara_rule

behavioral18/memory/840-0-0x0000000010000000-0x00000000101B9000-memory.dmp UPX
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

behavioral18/memory/840-0-0x0000000010000000-0x00000000101B9000-memory.dmp upx

resource	yara_rule
behavioral18/memory/840-0-0x0000000010000000-0x00000000101B9000-memory.dmp	UPX

resource	yara_rule
behavioral18/memory/840-0-0x0000000010000000-0x00000000101B9000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4312 wrote to memory of 840	4312	rundll32.exe	rundll32.exe
PID 4312 wrote to memory of 840	4312	rundll32.exe	rundll32.exe
PID 4312 wrote to memory of 840	4312	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\htmlayout.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4312

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\htmlayout.dll,#1
2⤵
PID:840

memory/840-0-0x0000000010000000-0x00000000101B9000-memory.dmp

Filesize
1.7MB

Download