30dee4d8bc635d90671f78228bc519318b71f07ba1e958c94e2de3b165078644

Analysis

max time kernel
164s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 08:05

Target

30dee4d8bc635d90671f78228bc519318b71f07ba1e958c94e2de3b165078644.dll
Size

12KB
MD5

4ce7458c5e6c370dc8aceb12826408b0
SHA1

9d9a8ae9e7d26e2678c00913d337cf2864edcce4
SHA256

30dee4d8bc635d90671f78228bc519318b71f07ba1e958c94e2de3b165078644
SHA512

d3ee39aed49920b1f8e2189d229aefc74f295d6a4df3855dc141454af5059a0dd33e5c2c8b1d73441dfbf41697fe22211d7fc5e0e92de9027fac90b607d475e3
SSDEEP

192:0AqObz3mDHCLGnZNKeSIfoM2GawqFi6AzryJlFzzrBo+VQaHBzfo9OXsL:bbz3IDK1IyZ86AzgFzzrBf7JXQ

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4788-133-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 4788	1360	rundll32.exe	80
PID 1360 wrote to memory of 4788	1360	rundll32.exe	80
PID 1360 wrote to memory of 4788	1360	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\30dee4d8bc635d90671f78228bc519318b71f07ba1e958c94e2de3b165078644.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\30dee4d8bc635d90671f78228bc519318b71f07ba1e958c94e2de3b165078644.dll,#1
  2⤵
  PID:4788

memory/4788-133-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download