346f1f008ade262276b1c1b6e17e8d6bd858ab0318aea2108175c05c8260b099

Analysis

max time kernel
122s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2022 22:50

Target

346f1f008ade262276b1c1b6e17e8d6bd858ab0318aea2108175c05c8260b099.dll
Size

56KB
MD5

0fd24262ebf721f9e3615cf9dcd1ac23
SHA1

85393866c73b49eb536b0034c9984d42989a454e
SHA256

346f1f008ade262276b1c1b6e17e8d6bd858ab0318aea2108175c05c8260b099
SHA512

bffc54ccb63cb80dedfe743e2ff8e2675d1b3abc100751a370df023be9fb1a9020f7cfebbbde22fc20ff444603ab10cd5f50b693388dfe3c3fb0a408ddc5ebe1
SSDEEP

1536:mPO6KEVbsVP0gFhh2XBJtnmS9GBpmKYQ73V6R6VCmNx9L7rtd:cMEVbsVcehIXZnmr88iwCm5/td

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1200-133-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 1200	5048	rundll32.exe	84
PID 5048 wrote to memory of 1200	5048	rundll32.exe	84
PID 5048 wrote to memory of 1200	5048	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\346f1f008ade262276b1c1b6e17e8d6bd858ab0318aea2108175c05c8260b099.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\346f1f008ade262276b1c1b6e17e8d6bd858ab0318aea2108175c05c8260b099.dll,#1
  2⤵
  PID:1200

memory/1200-132-0x0000000000000000-mapping.dmp

Download
memory/1200-133-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download