682ba3d034f4a6a0bbc192f48d3edcecff9cc49ee5cbfbe2a2f8ce79fbd26ea7

Analysis

max time kernel
159s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 20:07

Target

682ba3d034f4a6a0bbc192f48d3edcecff9cc49ee5cbfbe2a2f8ce79fbd26ea7.dll
Size

95KB
MD5

003ff77c213a257855ea612b3bfca6da
SHA1

2e78a6b6cdba426e9e8d1992eeea0ea3fb6fca58
SHA256

682ba3d034f4a6a0bbc192f48d3edcecff9cc49ee5cbfbe2a2f8ce79fbd26ea7
SHA512

2bc17749f5ca357a9e29f7cccb4787ddca188af0735655f99977f6b44a1a867400abf9185b9a0bc11dba8f42665717ecd1a8ca4d5ecbf5e1a62ad2e862275e8b
SSDEEP

1536:OkzBS5SxeEY2A13sb35Idz/i52V/bnGwEKeymqbe5+W0t:xYSxRA1cC852tnhrrn6B0t

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4204-133-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3800 wrote to memory of 4204	3800	rundll32.exe	79
PID 3800 wrote to memory of 4204	3800	rundll32.exe	79
PID 3800 wrote to memory of 4204	3800	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\682ba3d034f4a6a0bbc192f48d3edcecff9cc49ee5cbfbe2a2f8ce79fbd26ea7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\682ba3d034f4a6a0bbc192f48d3edcecff9cc49ee5cbfbe2a2f8ce79fbd26ea7.dll,#1
  2⤵
  PID:4204

memory/4204-133-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download