a1e365c7bd3d2f9c63344b5038d48633edde3f7385f1d39231137621129dd52d

Analysis

max time kernel
2s
max time network
8s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:30

Target

a1e365c7bd3d2f9c63344b5038d48633edde3f7385f1d39231137621129dd52d.dll
Size

330KB
MD5

bbd01424845abbfefd9bc05420684d92
SHA1

7bf4f61ef99c2f2bc79f46d457467cf531e1828d
SHA256

a1e365c7bd3d2f9c63344b5038d48633edde3f7385f1d39231137621129dd52d
SHA512

ee9ac333beb021785661aefc1e1e028481a4fca75fa2632517d53491a3c7526748465edaa41747c2e5869b4ea1aa2e2efc28071d365a50065848b2727aabedea
SSDEEP

6144:ylDldPOqoFmiYrO7bd/AssiDbu+2/zztPt/0HEZETtPnJj907z7:ylDldOIO/hN/Klq+stPnm

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/3188-139-0x00000000023F0000-0x0000000002406000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

rundll32.exe

pid process

3188 rundll32.exe

pid	process
3188	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2200 wrote to memory of 3188	2200	rundll32.exe	rundll32.exe
PID 2200 wrote to memory of 3188	2200	rundll32.exe	rundll32.exe
PID 2200 wrote to memory of 3188	2200	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1e365c7bd3d2f9c63344b5038d48633edde3f7385f1d39231137621129dd52d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2200

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1e365c7bd3d2f9c63344b5038d48633edde3f7385f1d39231137621129dd52d.dll,#1
2⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3188

memory/3188-132-0x0000000000000000-mapping.dmp

Download
memory/3188-133-0x0000000002150000-0x0000000002215000-memory.dmp

Filesize
788KB

Download
memory/3188-134-0x0000000002151000-0x000000000215C000-memory.dmp

Filesize
44KB

Download
memory/3188-139-0x00000000023F0000-0x0000000002406000-memory.dmp

Filesize
88KB

Download