1d3cac753c5ff248333fe1bf12b9879848d2ecdecb569267cbaf092985cbc717

Analysis

max time kernel
91s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2022, 15:56

Target

1d3cac753c5ff248333fe1bf12b9879848d2ecdecb569267cbaf092985cbc717.dll
Size

100KB
MD5

91094dee405cfae28385ee253102462e
SHA1

357fa9ea147c5f599096d69c5c45e8726072cfc2
SHA256

1d3cac753c5ff248333fe1bf12b9879848d2ecdecb569267cbaf092985cbc717
SHA512

a024739259e5f6a264d68c901817fb4a6c730b84db63089877ad301a56b3452dcf98dba45bcac30504dd11e3f770d1685cd9c3e61cc7edae8c47f0213a8a28a2
SSDEEP

1536:Zn4Mi33LS7enDxBZvM2ldyYvJtokfIvi6Mg+/ItxfG0Z+1EI/:Zfi3b8enD3WKJJfn6W/Iv8/

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4208-133-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 4208	1732	rundll32.exe	80
PID 1732 wrote to memory of 4208	1732	rundll32.exe	80
PID 1732 wrote to memory of 4208	1732	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d3cac753c5ff248333fe1bf12b9879848d2ecdecb569267cbaf092985cbc717.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d3cac753c5ff248333fe1bf12b9879848d2ecdecb569267cbaf092985cbc717.dll,#1
  2⤵
  PID:4208

memory/4208-133-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download