c62cab81c8b8f84870774963a8885b4b030acd792a33947179f4baa32d5788a3

Analysis

max time kernel
104s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18-09-2022 23:07

Target

c62cab81c8b8f84870774963a8885b4b030acd792a33947179f4baa32d5788a3.dll
Size

21KB
MD5

b4737adea4a5ce2345c739fe656a367d
SHA1

68ff595bd13e94978c728e49239667a786b4a04c
SHA256

c62cab81c8b8f84870774963a8885b4b030acd792a33947179f4baa32d5788a3
SHA512

7d5867b81a8e5a4b4283f5148db892b4fcca02ccd43f17e43fbdafd538e524245d6a95c492b274d7bb4ca229e93881033ea6947a81f8b7e121f8d590c28e21e5
SSDEEP

384:zhQmM2o6YgypY+QTHdAyUR4NckkJTJr3yBo4Nb6d0V7+sk/5Rz:zh22RYtpcq4SxsNWd05Ax

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4732-133-0x0000000010000000-0x0000000010015000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 4732	1048	rundll32.exe	82
PID 1048 wrote to memory of 4732	1048	rundll32.exe	82
PID 1048 wrote to memory of 4732	1048	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c62cab81c8b8f84870774963a8885b4b030acd792a33947179f4baa32d5788a3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c62cab81c8b8f84870774963a8885b4b030acd792a33947179f4baa32d5788a3.dll,#1
  2⤵
  PID:4732

memory/4732-133-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download