bfa900d0c124e863809c9af664bf40984fdef6611cd1ddf9f006d9cee7d62929

Analysis

max time kernel
113s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 03:35

Target

bfa900d0c124e863809c9af664bf40984fdef6611cd1ddf9f006d9cee7d62929.dll
Size

4KB
MD5

441f3e378910fe69b179f1463793f750
SHA1

720f230a5ae1d312c19aedfa71b5a3bbaa9e6a59
SHA256

bfa900d0c124e863809c9af664bf40984fdef6611cd1ddf9f006d9cee7d62929
SHA512

e8d809d7a51c11aeba239e3742958f340075e6034f80dd0270ebe76b99e262b90ebadbce02b2b8d4719b1ae317b70bb2019dc2aeb969b3524a5883a6821998c4
SSDEEP

96:TRphMzf8S0FL3n2HW27CCLE1juMZHjJelRb8:NpOr8SqX2HbOCESYklu

Score

9^/10

upx

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/memory/1192-133-0x0000000075680000-0x0000000075688000-memory.dmp	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1192-133-0x0000000075680000-0x0000000075688000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3964 wrote to memory of 1192	3964	rundll32.exe	82
PID 3964 wrote to memory of 1192	3964	rundll32.exe	82
PID 3964 wrote to memory of 1192	3964	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bfa900d0c124e863809c9af664bf40984fdef6611cd1ddf9f006d9cee7d62929.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bfa900d0c124e863809c9af664bf40984fdef6611cd1ddf9f006d9cee7d62929.dll,#1
  2⤵
  PID:1192

memory/1192-133-0x0000000075680000-0x0000000075688000-memory.dmp

Filesize
32KB

Download