861c06750abec5ec202c2873b494d2aeb7b2f1350077a689fa324342973da313

Analysis

max time kernel
121s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 07:49

Target

861c06750abec5ec202c2873b494d2aeb7b2f1350077a689fa324342973da313.dll
Size

112KB
MD5

932ec587a949baa01a6cd9e7674daaff
SHA1

e4d496e7322609a8f71216b73722d196d405ce64
SHA256

861c06750abec5ec202c2873b494d2aeb7b2f1350077a689fa324342973da313
SHA512

db5b881f19cb80b6465901b272444d1b8f67f71125c0aac20ba6b9215898d242f62e0f962e83d8699660cd037b4e2fd72432dc0c2698026e9adcddca4162c7fd
SSDEEP

1536:KnBaNaesiVFtZuPQsnAMwG9mk0zw7j7ecI5gJ:KQoY78IsAHJwv77ICJ

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/5096-133-0x0000000010000000-0x0000000010017000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 5096	4364	rundll32.exe	82
PID 4364 wrote to memory of 5096	4364	rundll32.exe	82
PID 4364 wrote to memory of 5096	4364	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\861c06750abec5ec202c2873b494d2aeb7b2f1350077a689fa324342973da313.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\861c06750abec5ec202c2873b494d2aeb7b2f1350077a689fa324342973da313.dll,#1
  2⤵
  PID:5096

memory/5096-133-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download