52de957ae8d66d9d4b6586147209ae4439fdf929f5c29384002783f4141d43a3

Analysis

max time kernel
91s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 03:52 UTC

Target

52de957ae8d66d9d4b6586147209ae4439fdf929f5c29384002783f4141d43a3.dll
Size

57KB
MD5

178b6c49266b293626f28194d8e59f40
SHA1

d6600295c84e0dc9c5c66622f53cc0969c4cfcbc
SHA256

52de957ae8d66d9d4b6586147209ae4439fdf929f5c29384002783f4141d43a3
SHA512

9b7c6799768547b54a965b3c65cfc67b322553bdc4cf98e8bdb8364a8e047cb3e176a59f4cf7cbfa155e22220a7a7d4175bdf30a6dbfef170a2dd6cb737b5732
SSDEEP

1536:YJEu0nVKxUzxVp8WvcFEcoq/P1STl/fm85Ojw:YmJnVKxUzRkFEcoq/P1STl/O8Ijw

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4916-133-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 4916	4452	rundll32.exe	80
PID 4452 wrote to memory of 4916	4452	rundll32.exe	80
PID 4452 wrote to memory of 4916	4452	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\52de957ae8d66d9d4b6586147209ae4439fdf929f5c29384002783f4141d43a3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\52de957ae8d66d9d4b6586147209ae4439fdf929f5c29384002783f4141d43a3.dll,#1
  2⤵
  PID:4916

memory/4916-133-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download