4877247f97af4e68781537a1c4c27a0553ae0198b7206c6143a7538b0651287f

Analysis

max time kernel
123s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-10-2022 20:10

Target

4877247f97af4e68781537a1c4c27a0553ae0198b7206c6143a7538b0651287f.dll
Size

980KB
MD5

a0b63f3b94196043606656186fe351b2
SHA1

ee1edbe253b8b589b23590ac31d5c6c8c73bf566
SHA256

4877247f97af4e68781537a1c4c27a0553ae0198b7206c6143a7538b0651287f
SHA512

5f733cf5144d969a4ea744e9ffaa50ab908901111a48bc620b0be899dc2026443baf94e1d251b09c41c1abc6d7e44eeb96e7e3b5d69edae99ee5f1c95752ceba
SSDEEP

24576:1wS2RJgABurjfkaHtrZrWCk1ViaeX/TiH6kU6:1FVrj5rZg1Vl6T4

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2744-133-0x0000000001460000-0x000000000146B000-memory.dmp	upx
behavioral2/memory/2744-134-0x0000000001460000-0x000000000146B000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 2744	5036	rundll32.exe	83
PID 5036 wrote to memory of 2744	5036	rundll32.exe	83
PID 5036 wrote to memory of 2744	5036	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4877247f97af4e68781537a1c4c27a0553ae0198b7206c6143a7538b0651287f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4877247f97af4e68781537a1c4c27a0553ae0198b7206c6143a7538b0651287f.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2744

memory/2744-132-0x0000000000000000-mapping.dmp

Download
memory/2744-133-0x0000000001460000-0x000000000146B000-memory.dmp

Filesize
44KB

Download
memory/2744-134-0x0000000001460000-0x000000000146B000-memory.dmp

Filesize
44KB

Download
memory/2744-135-0x0000000062E80000-0x0000000062E9F000-memory.dmp

Filesize
124KB

Download