23a57d0fde9db6cf023f3fee8bfd1564193550c5a30a65fea4e4e8d01c15f18f

Analysis

max time kernel
124s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 11:01

Target

23a57d0fde9db6cf023f3fee8bfd1564193550c5a30a65fea4e4e8d01c15f18f.dll
Size

49KB
MD5

4b6d3f24b827ad8232dacc100b27a8e0
SHA1

44d2e57ab512b770ea0c140031f93e081ed46a91
SHA256

23a57d0fde9db6cf023f3fee8bfd1564193550c5a30a65fea4e4e8d01c15f18f
SHA512

51117999e0a2c09c5df6339402af1518e49cb160e0cb31eca60c88988553796e47a3d9b495a200d256753f87192addeae904634d4e30ebe5c865f8afe4da0873
SSDEEP

768:kHwfLvO380aF15GyVj6sR4ufZR09UcCBTXGs4NPVzPCMc8IyM:kQfr0s5rYsX7WuBTXM1PCMc87M

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4456-133-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 4456	2744	rundll32.exe	84
PID 2744 wrote to memory of 4456	2744	rundll32.exe	84
PID 2744 wrote to memory of 4456	2744	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\23a57d0fde9db6cf023f3fee8bfd1564193550c5a30a65fea4e4e8d01c15f18f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\23a57d0fde9db6cf023f3fee8bfd1564193550c5a30a65fea4e4e8d01c15f18f.dll,#1
  2⤵
  PID:4456

memory/4456-133-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download