012cefe58105762ba4651dc6b52a09c50fd55150aeade7d44b643d0e909c1787

Analysis

max time kernel
117s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 13:24

Target

012cefe58105762ba4651dc6b52a09c50fd55150aeade7d44b643d0e909c1787.dll
Size

467KB
MD5

bbd4a115c96cc812ceceb9e78c091ce5
SHA1

bceadc1445d985f92c68343b78cbd207a3056f93
SHA256

012cefe58105762ba4651dc6b52a09c50fd55150aeade7d44b643d0e909c1787
SHA512

2b121ee1689ea50eec08ad1a131d24cfa461d17c3aea1f802c314f66ff6fcf72e099f5d731690465fdc6796cbe49602a6d0a7ec85723ce791a03616d9711b31b
SSDEEP

6144:9ASLh58phl+f471CjimlfsY3jtCSWqJJxV5OyhjbpaZp78SeCzh2k6pyqYjCshNh:99ghl+MihflcxeDV5T+p2kkGV2xWs

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1428-133-0x0000000000400000-0x000000000057B000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 1428	404	rundll32.exe	80
PID 404 wrote to memory of 1428	404	rundll32.exe	80
PID 404 wrote to memory of 1428	404	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\012cefe58105762ba4651dc6b52a09c50fd55150aeade7d44b643d0e909c1787.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:404
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\012cefe58105762ba4651dc6b52a09c50fd55150aeade7d44b643d0e909c1787.dll,#1
  2⤵
  PID:1428

memory/1428-133-0x0000000000400000-0x000000000057B000-memory.dmp

Filesize
1.5MB

Download