333fa9097f160adb348c2869d46316dab27dcc5b42a7287d93e201496c835140

Analysis

max time kernel
141s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 04:40

Target

333fa9097f160adb348c2869d46316dab27dcc5b42a7287d93e201496c835140.dll
Size

15KB
MD5

84070879c45c40135f670ee8bb0d4eb8
SHA1

2885eda5b12ee763409045d918e2904d4e17af67
SHA256

333fa9097f160adb348c2869d46316dab27dcc5b42a7287d93e201496c835140
SHA512

07f4b11da870bd0922051a9150aead1c2227b60c9ff049f2dc0723b1984cfdfb86abeb66123f0bc9c9d726a1583683b119ace3428c2d75f0fb15fe27d053ff06
SSDEEP

384:wpZUxKjQXjp5xfWxoVT1d23SvQnYUqtdg/gs+s:2/QTpXuxoVJd2ioPqD8B

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4084-133-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 4084	4196	rundll32.exe	80
PID 4196 wrote to memory of 4084	4196	rundll32.exe	80
PID 4196 wrote to memory of 4084	4196	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\333fa9097f160adb348c2869d46316dab27dcc5b42a7287d93e201496c835140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\333fa9097f160adb348c2869d46316dab27dcc5b42a7287d93e201496c835140.dll,#1
  2⤵
  PID:4084

memory/4084-133-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download