fae305eb47c0fde58de77499a31fe6151290e85b3448b81d7152e101275e1efe

Analysis

max time kernel
141s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2022, 18:14

Target
fae305eb47c0fde58de77499a31fe6151290e85b3448b81d7152e101275e1efe.dll
Size 167KB
Sample221012-wvs4saehcr
SHA256 fae305eb47c0fde58de77499a31fe6151290e85b3448b81d7152e101275e1efe
MD5 7a67140b27a9c1a2d6002798b6795dcb
SHA1 7af989749f8d610d1da0c50c6e2cb427a9d904ee
SHA512 d9ae9b9904e046435c3a9a629bb351208383cf4e41722e749a5bebefa2395287ef82a5f8a90d7fc23939f3d6447294a13973f30d3b35a296493cb96d225854cf
SSDEEP 3072:RkURK5C0BxszHItJkBh7eQM03F7+i/itLJU0lHjeL8SHSvza:R/M5uzHFBhCQMIFS4OJP6w8SLa
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4064-133-0x0000000000600000-0x000000000066E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 4064	2624	rundll32.exe	83
PID 2624 wrote to memory of 4064	2624	rundll32.exe	83
PID 2624 wrote to memory of 4064	2624	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fae305eb47c0fde58de77499a31fe6151290e85b3448b81d7152e101275e1efe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fae305eb47c0fde58de77499a31fe6151290e85b3448b81d7152e101275e1efe.dll,#1
  2⤵
  PID:4064

memory/4064-133-0x0000000000600000-0x000000000066E000-memory.dmp

Download