4ebf9a60d787af4178ef5786d5228414fdc37c258aa5894b194f786f2932cdd9

Analysis

max time kernel
150s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2022 17:00

Target

4ebf9a60d787af4178ef5786d5228414fdc37c258aa5894b194f786f2932cdd9.dll
Size

16KB
MD5

26031c2373fa9711950e0022f2b8b64d
SHA1

cc1682eb3f098a618690f3c4d7affb74def3701a
SHA256

4ebf9a60d787af4178ef5786d5228414fdc37c258aa5894b194f786f2932cdd9
SHA512

64b97abc45fec925c4f1bbd09a62cc21b92dbf0f4d210e465ac99e14617f50002cee2d7075b192f7f37631084b045ab3bef807aeeb89861b3e52670f3a0104b3
SSDEEP

384:Eg/9m7f9OzuPlMco4F5hAK8gAEOK4/vGzpSApY:KfAzBco0TAK8dEVSvGzzi

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3912-133-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/3912-134-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 3912	4796	rundll32.exe	81
PID 4796 wrote to memory of 3912	4796	rundll32.exe	81
PID 4796 wrote to memory of 3912	4796	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ebf9a60d787af4178ef5786d5228414fdc37c258aa5894b194f786f2932cdd9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ebf9a60d787af4178ef5786d5228414fdc37c258aa5894b194f786f2932cdd9.dll,#1
  2⤵
  PID:3912

memory/3912-132-0x0000000000000000-mapping.dmp

Download
memory/3912-133-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3912-134-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download