a81bace126d0240231793305b6b6f9adaf5d19d458bdd0a13398a246ddfa0462

Analysis

max time kernel
141s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 16:05

Target

a81bace126d0240231793305b6b6f9adaf5d19d458bdd0a13398a246ddfa0462.dll
Size

104KB
MD5

82b181c4e76063b0a9639224a60d79a8
SHA1

cd6d7f7637984970d37301cfdc7787ecccc5c153
SHA256

a81bace126d0240231793305b6b6f9adaf5d19d458bdd0a13398a246ddfa0462
SHA512

9881eac64463c140fca4aef49bf1756f53b3a8a7673a7cfef563536c101b3322f7643e796845f1d02d9ee1e065864a70b45c14df32988d26e304c93c3daa0d4f
SSDEEP

3072:gyLSzErUuy6ADDkUFeedzi5IzY9RT7jvbV7I:gyJQV6ADDEedzi5Iyrx0

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2436-133-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 2436	4956	rundll32.exe	78
PID 4956 wrote to memory of 2436	4956	rundll32.exe	78
PID 4956 wrote to memory of 2436	4956	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a81bace126d0240231793305b6b6f9adaf5d19d458bdd0a13398a246ddfa0462.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a81bace126d0240231793305b6b6f9adaf5d19d458bdd0a13398a246ddfa0462.dll,#1
  2⤵
  PID:2436

memory/2436-133-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download