d95b08ae1e5e92ad70ac02a859a6750721e55356afca3d76ba245a301ee6f16b

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2022, 10:45

Target

d95b08ae1e5e92ad70ac02a859a6750721e55356afca3d76ba245a301ee6f16b.dll
Size

54KB
MD5

66fef9b3b625f29a186d10108c9e7265
SHA1

05a77afd0b5f6ffb1ca092462a5d65b86c81fdbe
SHA256

d95b08ae1e5e92ad70ac02a859a6750721e55356afca3d76ba245a301ee6f16b
SHA512

dce59749506fdfaa86d1fd82f559de5fad3e400c886b50f99b1299fec2adfdc70d7954ee6fdbb318ce73fafddb3b8574ebc1fb747864fc856a0f696b675f7b08
SSDEEP

768:syfVuhZwG5HSdaDG0hdT+mnTED8/maV3vGzzZ:sbwud9VpQzZ

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3252-136-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 3252	4644	rundll32.exe	82
PID 4644 wrote to memory of 3252	4644	rundll32.exe	82
PID 4644 wrote to memory of 3252	4644	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d95b08ae1e5e92ad70ac02a859a6750721e55356afca3d76ba245a301ee6f16b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d95b08ae1e5e92ad70ac02a859a6750721e55356afca3d76ba245a301ee6f16b.dll,#1
  2⤵
  PID:3252

memory/3252-136-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download