edbd65aeae5d6d697b727f2ebd34bac550b0dc8337feaf71e609686a027ba925

Analysis

max time kernel
223s
max time network
227s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2022 07:37

Target

edbd65aeae5d6d697b727f2ebd34bac550b0dc8337feaf71e609686a027ba925.dll
Size

92KB
MD5

2fd27975ea08ab49f6cf00be325c8fb0
SHA1

2795e4e563a7b9f97d886dcc8cdcf8e51707706b
SHA256

edbd65aeae5d6d697b727f2ebd34bac550b0dc8337feaf71e609686a027ba925
SHA512

9dfabec49251ca0bbc5de7ab17a9e3e17c5e341e13523fabcbbe5352a11e17e2e2e1f3a1432ea834aa5a9bd5e1b421546d8ff6c0f6061991365d71be87648015
SSDEEP

1536:Zn4Mi33LS7enDxBOTZAgl8QhR9iGTo4deGrYzpB989E5mikVDW/a:Zfi3b8enD3OtR3JzTJdPe8G5NkVDWi

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1028-133-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 1028	4852	rundll32.exe	79
PID 4852 wrote to memory of 1028	4852	rundll32.exe	79
PID 4852 wrote to memory of 1028	4852	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\edbd65aeae5d6d697b727f2ebd34bac550b0dc8337feaf71e609686a027ba925.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\edbd65aeae5d6d697b727f2ebd34bac550b0dc8337feaf71e609686a027ba925.dll,#1
  2⤵
  PID:1028

memory/1028-133-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download