d0ff956443efa2c2938581f768867b81754bda4fe35473abca8c9b703f8fe8d5

Analysis

max time kernel
197s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 03:54

Target

d0ff956443efa2c2938581f768867b81754bda4fe35473abca8c9b703f8fe8d5.dll
Size

44KB
MD5

22493792e855a9230acb24dc57cac640
SHA1

88267adfe77c44305181dbf298ec08f7624bc179
SHA256

d0ff956443efa2c2938581f768867b81754bda4fe35473abca8c9b703f8fe8d5
SHA512

540e1de64e046ca66fa53e2996a7fbde72119921668459647381d129a39765b4ec09f25a32ebbccbab87b61333515cef7ecf72d1ee9c8bec6c9b765d8550cb33
SSDEEP

768:kHwfLvO380aXEJJPHS+lELLonCw5MV80LvClbAY+FZOxbN/zeVE:kQfr0aEJJPyI5z5G8uqNQZOHn

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2604-133-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 2604	1468	rundll32.exe	80
PID 1468 wrote to memory of 2604	1468	rundll32.exe	80
PID 1468 wrote to memory of 2604	1468	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d0ff956443efa2c2938581f768867b81754bda4fe35473abca8c9b703f8fe8d5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d0ff956443efa2c2938581f768867b81754bda4fe35473abca8c9b703f8fe8d5.dll,#1
  2⤵
  PID:2604

memory/2604-133-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download