15179bae6e4b3322c38aca6dcfc5026a4a9035e699288c703efd283195943920

Analysis

max time kernel
178s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 18:52

Target

15179bae6e4b3322c38aca6dcfc5026a4a9035e699288c703efd283195943920.dll
Size

16KB
MD5

44b5a3903a31decee85e64992c576480
SHA1

390e8b335dfc1b8ac2aa0055a6f206d1cfee67a1
SHA256

15179bae6e4b3322c38aca6dcfc5026a4a9035e699288c703efd283195943920
SHA512

658aebe3f2090a446c396aa7665623154ef8cfbccce0cc1cef0dc24814fcf4568adbf12c3d35fc22d5a9051fa051af12134ba0928a5f2225fd2c80346d740a36
SSDEEP

384:Eg/9m7f9OzuPlMco4F5hAK8gAEOK4/vGzpSApE:KfAzBco0TAK8dEVSvGzz6

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/1588-133-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1588-134-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1756 wrote to memory of 1588	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1588	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1588	1756	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\15179bae6e4b3322c38aca6dcfc5026a4a9035e699288c703efd283195943920.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\15179bae6e4b3322c38aca6dcfc5026a4a9035e699288c703efd283195943920.dll,#1
2⤵
PID:1588

memory/1588-132-0x0000000000000000-mapping.dmp

Download
memory/1588-133-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1588-134-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download