96fd196d618d883cdefccd8446040e728987b726bbcaf9acf222d5e9320ee190

Analysis

max time kernel
52s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 12:48

Target

96fd196d618d883cdefccd8446040e728987b726bbcaf9acf222d5e9320ee190.dll
Size

56KB
MD5

66962924b3e1297901495a65471cf956
SHA1

4093cd87d02793ef1b230ae9b89da571689e4d72
SHA256

96fd196d618d883cdefccd8446040e728987b726bbcaf9acf222d5e9320ee190
SHA512

b97d10a16a03a0c74263400d665c895a11f03937fb2eb1d2f8215a1aba8fb2223053305b2c556b3a65da89196fa156f235a4e8d12090893b32eaae588615bfeb
SSDEEP

1536:MhBRVgrExucMEMfCDNiZIwsGiqnrekJM6euxJy0tsD2E:cRRs/CDgqoaP0+D2E

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1200-133-0x0000000010000000-0x0000000010017000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3172 wrote to memory of 1200	3172	rundll32.exe	82
PID 3172 wrote to memory of 1200	3172	rundll32.exe	82
PID 3172 wrote to memory of 1200	3172	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\96fd196d618d883cdefccd8446040e728987b726bbcaf9acf222d5e9320ee190.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\96fd196d618d883cdefccd8446040e728987b726bbcaf9acf222d5e9320ee190.dll,#1
  2⤵
  PID:1200

memory/1200-133-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download