96af1a228fcf97389d54f3c416255071d409f2390fc00de9805ca3ecd653a52d

Analysis

max time kernel
125s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2022, 07:43

Target

96af1a228fcf97389d54f3c416255071d409f2390fc00de9805ca3ecd653a52d.dll
Size

58KB
MD5

50c169f3cb3d59f44d68bd3f2d28ad30
SHA1

8e7caa5958a0a33a98d58c5d56cb7a967845ea46
SHA256

96af1a228fcf97389d54f3c416255071d409f2390fc00de9805ca3ecd653a52d
SHA512

b9f327c1f5f20b2a52fb789db1abbb149f33fe3c6b37bb9d6b26aec314b50d4c69d90beb2a6bd5134d9eb45121f647b484751301f8652371cf342f2eef7b4954
SSDEEP

1536:yl3E0T6iMZHUxtjyxsLRZ6+GKps+fO5F19GE9J7s1P:E39x20x0xsLRXCB/Ji

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3188-133-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 3188	1688	rundll32.exe	80
PID 1688 wrote to memory of 3188	1688	rundll32.exe	80
PID 1688 wrote to memory of 3188	1688	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\96af1a228fcf97389d54f3c416255071d409f2390fc00de9805ca3ecd653a52d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\96af1a228fcf97389d54f3c416255071d409f2390fc00de9805ca3ecd653a52d.dll,#1
  2⤵
  PID:3188

memory/3188-133-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download