b21811e33069c10aee14d96d7a28818b25715db6434e2ca5e268be845425300a

Analysis

max time kernel
91s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 06:28

Target

b21811e33069c10aee14d96d7a28818b25715db6434e2ca5e268be845425300a.dll
Size

57KB
MD5

7b7a161e366c327d837de48e519cf78c
SHA1

615450dbfcebb81c189aaed175b9ea9a3f912dad
SHA256

b21811e33069c10aee14d96d7a28818b25715db6434e2ca5e268be845425300a
SHA512

1687a4f632b367f320f07d3143bccca4dfef3908cc312734f94c13c42a78c7e4029b42aafb9c19e51f36816e77b7515bd9c89b60a42b6b4885874864c199bac7
SSDEEP

768:h8WTpVT0X8zbXmDRrIs6q6xnC2eafI1sZ0WhOvGI26tubLlduzeHxueL28cak:RVzoIM6UxzBWhGywzexL2B

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/5024-133-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 5024	4988	rundll32.exe	81
PID 4988 wrote to memory of 5024	4988	rundll32.exe	81
PID 4988 wrote to memory of 5024	4988	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b21811e33069c10aee14d96d7a28818b25715db6434e2ca5e268be845425300a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b21811e33069c10aee14d96d7a28818b25715db6434e2ca5e268be845425300a.dll,#1
  2⤵
  PID:5024

memory/5024-133-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download