d733e844097dbed20c4fdd6efcf68f338259c0012a55b69e604e6157a1f13ba6

Analysis

max time kernel
127s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 21:02

Target

d733e844097dbed20c4fdd6efcf68f338259c0012a55b69e604e6157a1f13ba6.dll
Size

16KB
MD5

a12d3e28dd45b6efd5f383e183da4624
SHA1

3fb71d8c6f59cd5e08f0e0aeb31faca3b9f48d6e
SHA256

d733e844097dbed20c4fdd6efcf68f338259c0012a55b69e604e6157a1f13ba6
SHA512

c9d68b84599b6ccf22759aa43b4dc5d4e9c2642701e2709617585b611be16ef2b1e912c0ba1fc29fcca17319e34574d03b6f676fa87c0c18dd289c11b0911dd3
SSDEEP

384:Eg/9m7f9OzuPlMco4F5hAK8gAEOK4/vGzpSApv:KfAzBco0TAK8dEVSvGzz5

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4856-133-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 4856	4968	rundll32.exe	82
PID 4968 wrote to memory of 4856	4968	rundll32.exe	82
PID 4968 wrote to memory of 4856	4968	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d733e844097dbed20c4fdd6efcf68f338259c0012a55b69e604e6157a1f13ba6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d733e844097dbed20c4fdd6efcf68f338259c0012a55b69e604e6157a1f13ba6.dll,#1
  2⤵
  PID:4856

memory/4856-133-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download