0cea3c419d4a68f81358fcc4eedbf462b16afad4f713876c3b1461d900ed90c1

Analysis

max time kernel
136s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2022 11:02

Target

0cea3c419d4a68f81358fcc4eedbf462b16afad4f713876c3b1461d900ed90c1.dll
Size

59KB
MD5

68e0fcbb03ca43dd551db525c0d22cfd
SHA1

8c49ef44a82992e2016ffa17d941ef71f20ec5d7
SHA256

0cea3c419d4a68f81358fcc4eedbf462b16afad4f713876c3b1461d900ed90c1
SHA512

6898b9cd1250aa599791d49be941837ac92f5179fcb1c53f7609c2561c9c1e7b87f67ac0e9c56d6fdc1a2b3375f3aeb31fdadfa498725693c61584f130dec96f
SSDEEP

1536:evwOcJ8nBzKxb8oWCeR1iXd1SKsgS7a6eED+ekihWFnSF:IcJ8nBzKxb8oWhkdsKLS7GqzEA

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/8-133-0x0000000010000000-0x000000001000C000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 8	4900	rundll32.exe	81
PID 4900 wrote to memory of 8	4900	rundll32.exe	81
PID 4900 wrote to memory of 8	4900	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0cea3c419d4a68f81358fcc4eedbf462b16afad4f713876c3b1461d900ed90c1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0cea3c419d4a68f81358fcc4eedbf462b16afad4f713876c3b1461d900ed90c1.dll,#1
  2⤵
  PID:8

memory/8-133-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download