7654e3c3e34aaecc5b73193be5b6207ef008ef2cf94625c9d3f3a63477c21574

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 13:33

Target

7654e3c3e34aaecc5b73193be5b6207ef008ef2cf94625c9d3f3a63477c21574.dll
Size

75KB
MD5

07bc5b2bc3448b1e5e6afad4f01b9adf
SHA1

2d9f1bfd10b423be737778f5d04133174af20741
SHA256

7654e3c3e34aaecc5b73193be5b6207ef008ef2cf94625c9d3f3a63477c21574
SHA512

51943d495a0f2eaa277cced1796378baa1f4261f46a457248c2f8d6b953ba208f62c8f7e2e2565db0668e08e52de420e38aacddf0d82ce1829a59b9a821495b2
SSDEEP

1536:GVfbiZD+V193zvBmTf8I4zVlfzvbc0Y/tBKzj:GhVfv4Tfx4Rlfzvbc047KP

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/360-133-0x0000000010000000-0x0000000010410000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 360	4640	rundll32.exe	80
PID 4640 wrote to memory of 360	4640	rundll32.exe	80
PID 4640 wrote to memory of 360	4640	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7654e3c3e34aaecc5b73193be5b6207ef008ef2cf94625c9d3f3a63477c21574.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7654e3c3e34aaecc5b73193be5b6207ef008ef2cf94625c9d3f3a63477c21574.dll,#1
  2⤵
  PID:360

memory/360-133-0x0000000010000000-0x0000000010410000-memory.dmp

Filesize
4.1MB

Download
memory/360-134-0x0000000010000000-0x0000000010410000-memory.dmp

Filesize
4.1MB

Download