5e888dfe1b4b99368b9a23bdbfc9f7d7981eabcc1a2bbbc594dcdbe09f320d69

Analysis

max time kernel
91s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 07:42

Target

5e888dfe1b4b99368b9a23bdbfc9f7d7981eabcc1a2bbbc594dcdbe09f320d69.dll
Size

106KB
MD5

936f107a372ab46371a9462a6ccacace
SHA1

edc5f9c2d5fed534041b125b76a3565317d89676
SHA256

5e888dfe1b4b99368b9a23bdbfc9f7d7981eabcc1a2bbbc594dcdbe09f320d69
SHA512

5fc993a07324b283f57433fb5fb0e7fbe8dcb98207f73e19651fd95f0462b7588c4435a73034d95c39376427aee4cff22075c583b8fd6e5f42b49fa81d2b5050
SSDEEP

1536:i64W3b/+sHTUxLuFuC8QURP48qrtJ/kBjufno2V7d95bp:1b/+sHN38QURP48qrtmjwn9V5bp

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4856-133-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 4856	4880	rundll32.exe	25
PID 4880 wrote to memory of 4856	4880	rundll32.exe	25
PID 4880 wrote to memory of 4856	4880	rundll32.exe	25

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e888dfe1b4b99368b9a23bdbfc9f7d7981eabcc1a2bbbc594dcdbe09f320d69.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e888dfe1b4b99368b9a23bdbfc9f7d7981eabcc1a2bbbc594dcdbe09f320d69.dll,#1
  2⤵
  PID:4856

memory/4856-133-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download