16f9807f5f5eeff171bc174ce9949a84c9b42bc0151122a131fdccd2f46069b3

Analysis

max time kernel
92s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 04:26

Target

16f9807f5f5eeff171bc174ce9949a84c9b42bc0151122a131fdccd2f46069b3.dll
Size

83KB
MD5

4a191dbbb6032442d84fca4376355d7b
SHA1

1a77305e633fa138cd7c8c14b210fc4cab388da8
SHA256

16f9807f5f5eeff171bc174ce9949a84c9b42bc0151122a131fdccd2f46069b3
SHA512

df48b675d7b6d3f62f89f0bd19fa3beedc69ceee53b92f51217687a92d220ee82f753668cd8143ff7945bd087ecfbc633be2cb42da76ab59358822b6cccd2d03
SSDEEP

1536:evzuTUOg9RSdq3PfVt370GvttcphlLyfaJXJ6jpRog0e4:2h9RSdYfv8LoaJXJipce4

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4336-133-0x0000000010000000-0x000000001000C000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 4336	1600	rundll32.exe	83
PID 1600 wrote to memory of 4336	1600	rundll32.exe	83
PID 1600 wrote to memory of 4336	1600	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\16f9807f5f5eeff171bc174ce9949a84c9b42bc0151122a131fdccd2f46069b3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\16f9807f5f5eeff171bc174ce9949a84c9b42bc0151122a131fdccd2f46069b3.dll,#1
  2⤵
  PID:4336

memory/4336-133-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download