327ab7e1e865b5940d6be494d57605fec41f68c24ade391bdd2e7275e4cdc661

Analysis

max time kernel
119s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2022 15:28

Target

327ab7e1e865b5940d6be494d57605fec41f68c24ade391bdd2e7275e4cdc661.dll
Size

16KB
MD5

81ee7d136be30746790d21e41a52a820
SHA1

6d116621ebbaf1116af9298d47236d36554910d8
SHA256

327ab7e1e865b5940d6be494d57605fec41f68c24ade391bdd2e7275e4cdc661
SHA512

6c2eb9503b9b56f4a7159b1b5bd152a93087a6cbe03fdcc178db66a1b12fbb3fc5562d6f5baec7f8939c1ec5a5878ffc74c953faa738ee07a38e8dd37b81fb3d
SSDEEP

384:Eg/9m7f9OzuPlMco4F5hAK8gAEOK4/vGzpSAp7:KfAzBco0TAK8dEVSvGzzF

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1948-133-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1948-134-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 1948	2588	rundll32.exe	80
PID 2588 wrote to memory of 1948	2588	rundll32.exe	80
PID 2588 wrote to memory of 1948	2588	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\327ab7e1e865b5940d6be494d57605fec41f68c24ade391bdd2e7275e4cdc661.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\327ab7e1e865b5940d6be494d57605fec41f68c24ade391bdd2e7275e4cdc661.dll,#1
  2⤵
  PID:1948

memory/1948-133-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1948-134-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download