747674b1e1e9c87801375d343524fd0b2a20dae104d4dd08a9f8caacec2aa8dc

Analysis

max time kernel
94s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2022, 17:07

Target

747674b1e1e9c87801375d343524fd0b2a20dae104d4dd08a9f8caacec2aa8dc.dll
Size

77KB
MD5

453c3f33a245c8c080f07898c96ad320
SHA1

73ae9621d665204502b14a150c55b326c9b0c6b1
SHA256

747674b1e1e9c87801375d343524fd0b2a20dae104d4dd08a9f8caacec2aa8dc
SHA512

c0d6a0058309dbe6bd73e1449e7633aaed11cac79fe667c24297af1f0ec6d58782efd49c8e06eeffc2af63b0d3d4f73eebe56da37a88d634514ac9df864441b8
SSDEEP

1536:ob8Vwn/agAruWsVq47Wdvr1kxhnpLLMikk8T0Paj5iMBU8HWafhhB45:oz/3BLVJ6dvr1ehpkiH8T0gOgjk

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3640-133-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 3640	3284	rundll32.exe	81
PID 3284 wrote to memory of 3640	3284	rundll32.exe	81
PID 3284 wrote to memory of 3640	3284	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\747674b1e1e9c87801375d343524fd0b2a20dae104d4dd08a9f8caacec2aa8dc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\747674b1e1e9c87801375d343524fd0b2a20dae104d4dd08a9f8caacec2aa8dc.dll,#1
  2⤵
  PID:3640

memory/3640-133-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download