f489ee6a727ef6f9192ec9add719015be228afe7decd9d9b8e97a24c1f14d630

Analysis

max time kernel
97s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 23:01

Target

f489ee6a727ef6f9192ec9add719015be228afe7decd9d9b8e97a24c1f14d630.dll
Size

66KB
MD5

073bff07a9638954af6a779e5892caf8
SHA1

16a1f58055d56fcfc203e7a556df33be684243dd
SHA256

f489ee6a727ef6f9192ec9add719015be228afe7decd9d9b8e97a24c1f14d630
SHA512

685beec3ad36e5229956bc33201d64dabecda7023c0be80e26ef0f1a33ea0759d0ae59479c0f3d738dca2e8f0b0bbb8f07f6b062aef056ad68aad49441b73d93
SSDEEP

1536:HKvv9jeCw6l9n+Eu2U/I+6cJDbI1YtxkTuXQCNa9+7fKSYQQf:TSHu2U/IpclI1CxkSXxa+fKNQU

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4792-133-0x0000000010000000-0x0000000010664000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 4792	3372	rundll32.exe	80
PID 3372 wrote to memory of 4792	3372	rundll32.exe	80
PID 3372 wrote to memory of 4792	3372	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f489ee6a727ef6f9192ec9add719015be228afe7decd9d9b8e97a24c1f14d630.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f489ee6a727ef6f9192ec9add719015be228afe7decd9d9b8e97a24c1f14d630.dll,#1
  2⤵
  PID:4792

memory/4792-133-0x0000000010000000-0x0000000010664000-memory.dmp

Filesize
6.4MB

Download