66518898514a7a6390e86f1e47fb54f861d4c8018b8ae13b8026179adb6cfeb0

Analysis

max time kernel
118s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2022, 04:13

Target

66518898514a7a6390e86f1e47fb54f861d4c8018b8ae13b8026179adb6cfeb0.dll
Size

98KB
MD5

71c45ca05481d04355d03253d3e706ba
SHA1

40864404d6be1777ce7de2f1e1468b1cf00fecdf
SHA256

66518898514a7a6390e86f1e47fb54f861d4c8018b8ae13b8026179adb6cfeb0
SHA512

221a73c4e4a3901c34a04c357103193da643caabe406d6f25f2562c780a5d12dedc0063a5e683dbdf330b7dbe08ae1960f1c14608389f55fdeee543996582e56
SSDEEP

1536:2ZfRBV0QVXvur5Y73nzgjdLVeQrBIXt0R1aeSa97P7k01A:UfRBuQVX25Y7wFZrBcKvSahu

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2708-133-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 2708	4352	rundll32.exe	82
PID 4352 wrote to memory of 2708	4352	rundll32.exe	82
PID 4352 wrote to memory of 2708	4352	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\66518898514a7a6390e86f1e47fb54f861d4c8018b8ae13b8026179adb6cfeb0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\66518898514a7a6390e86f1e47fb54f861d4c8018b8ae13b8026179adb6cfeb0.dll,#1
  2⤵
  PID:2708

memory/2708-133-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download