17c838934ee82d11ec3d2dea33904aab364f07f73f94708d1e3aef4f6a6a83f4

Analysis

max time kernel
184s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 20:05

Target

17c838934ee82d11ec3d2dea33904aab364f07f73f94708d1e3aef4f6a6a83f4.dll
Size

128KB
MD5

3aec600eb810a078fb367ea14271d95c
SHA1

c727d68d2ea52a4fc24b4062de3da010c7aba9b5
SHA256

17c838934ee82d11ec3d2dea33904aab364f07f73f94708d1e3aef4f6a6a83f4
SHA512

3137505e90b823be26afb3a3dc45927631b6c693158de854bc5dde47acad35a4f9b03f035bad8d5952f4ff37fd72396e852893babd3f994ad7507d522eb67852
SSDEEP

1536:vJAbErxg2EizoBXJAbErxg2EizoBXJAbErxg2EizoBUqlJ7DvlE2kJAbErxg2EiD:TgZbgZbgZp/Hm3gZbgZ

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3416-133-0x0000000010000000-0x0000000010016000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 3416	1436	rundll32.exe	78
PID 1436 wrote to memory of 3416	1436	rundll32.exe	78
PID 1436 wrote to memory of 3416	1436	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\17c838934ee82d11ec3d2dea33904aab364f07f73f94708d1e3aef4f6a6a83f4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\17c838934ee82d11ec3d2dea33904aab364f07f73f94708d1e3aef4f6a6a83f4.dll,#1
  2⤵
  PID:3416

memory/3416-133-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download