623938401590e2f7e8ebdebdadbf2109ffe34081d10986108e9afe4197d5bdfb

Analysis

max time kernel
266s
max time network
285s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:09

Target

623938401590e2f7e8ebdebdadbf2109ffe34081d10986108e9afe4197d5bdfb.dll
Size

957KB
MD5

6b893357591f6c8ec3d498aa70f108c1
SHA1

37a78c684ffd092c2643110e33261c2f262f8f45
SHA256

623938401590e2f7e8ebdebdadbf2109ffe34081d10986108e9afe4197d5bdfb
SHA512

9856da7182fbb2959d137e669706b71762bef5c6d64555e2bf108ab397a982f8ef6759a7e9a0844b425ba8062e9dd0914b249c90ad1dd144a23d1345722a70c0
SSDEEP

24576:nFFaulyI9W5+NLVOh0hxgSCGHdCVU4bwQOqqf:nFKII5gOtSWuKD

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/5008-133-0x0000000002220000-0x0000000002518000-memory.dmp	upx
behavioral2/memory/5008-134-0x0000000002220000-0x0000000002518000-memory.dmp	upx
behavioral2/memory/5008-135-0x0000000002220000-0x0000000002518000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4024 wrote to memory of 5008	4024	rundll32.exe	rundll32.exe
PID 4024 wrote to memory of 5008	4024	rundll32.exe	rundll32.exe
PID 4024 wrote to memory of 5008	4024	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\623938401590e2f7e8ebdebdadbf2109ffe34081d10986108e9afe4197d5bdfb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\623938401590e2f7e8ebdebdadbf2109ffe34081d10986108e9afe4197d5bdfb.dll,#1
  2⤵
  PID:5008

memory/5008-132-0x0000000000000000-mapping.dmp

Download
memory/5008-133-0x0000000002220000-0x0000000002518000-memory.dmp

Filesize
3.0MB

Download
memory/5008-134-0x0000000002220000-0x0000000002518000-memory.dmp

Filesize
3.0MB

Download
memory/5008-135-0x0000000002220000-0x0000000002518000-memory.dmp

Filesize
3.0MB

Download
memory/5008-136-0x0000000002220000-0x0000000002518000-memory.dmp

Filesize
3.0MB

Download
memory/5008-137-0x0000000000760000-0x0000000000764000-memory.dmp

Filesize
16KB

Download
memory/5008-138-0x0000000002220000-0x0000000002518000-memory.dmp

Filesize
3.0MB

Download