564355ba4eefd932826fac8c285608ddb7b4524dde1b6f360f1a31f63e4153de

Analysis

max time kernel
117s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2022, 07:44

Target

564355ba4eefd932826fac8c285608ddb7b4524dde1b6f360f1a31f63e4153de.dll
Size

67KB
MD5

4301587d10e4d3fdc010afee6dbb004d
SHA1

69b4b55b3a21d82c24fe02ffc187245e7acfacaa
SHA256

564355ba4eefd932826fac8c285608ddb7b4524dde1b6f360f1a31f63e4153de
SHA512

98337d19da7abea25d7038c1cbf151d46f38c9107e845f9824416eee068934b41b77f8a6caa85099c912448ffcf864228c7a7201978386eda2373a917fa49b80
SSDEEP

1536:EGS0Xh5Gf7MLY4i0w1GWuM+7WPJBh3yN0zHVFjeRh4Lr:EGS0XhIYLvi0bWupWPJBNyN0jVFSRmLr

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/5068-133-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 5068	2828	rundll32.exe	81
PID 2828 wrote to memory of 5068	2828	rundll32.exe	81
PID 2828 wrote to memory of 5068	2828	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\564355ba4eefd932826fac8c285608ddb7b4524dde1b6f360f1a31f63e4153de.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\564355ba4eefd932826fac8c285608ddb7b4524dde1b6f360f1a31f63e4153de.dll,#1
  2⤵
  PID:5068

memory/5068-133-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download