b0c4c11c72cb42eab90c14399c02d9b3f24a4375d737fee2ebd3ac9380c3d9d5

Analysis

max time kernel
185s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 20:13

Target

b0c4c11c72cb42eab90c14399c02d9b3f24a4375d737fee2ebd3ac9380c3d9d5.dll
Size

91KB
MD5

25a562cfbcb91ed3a3257a28f427a253
SHA1

4e509b036b04871156fbc90dc4772e53a73008dc
SHA256

b0c4c11c72cb42eab90c14399c02d9b3f24a4375d737fee2ebd3ac9380c3d9d5
SHA512

4b486bd01a44335af30e549647a497f87ee4acd721ff28cd63be411aa63a4965bacea5ba2434e09b542092666633718c3bee71783573c359d752395b202cef70
SSDEEP

1536:Nh1fL15Vx2G5bCgsSeUzRHGId+K4ml34qNopY67oUcN:Nh53p5NIe0WFopYhfN

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/440-133-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 440	1996	rundll32.exe	81
PID 1996 wrote to memory of 440	1996	rundll32.exe	81
PID 1996 wrote to memory of 440	1996	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b0c4c11c72cb42eab90c14399c02d9b3f24a4375d737fee2ebd3ac9380c3d9d5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b0c4c11c72cb42eab90c14399c02d9b3f24a4375d737fee2ebd3ac9380c3d9d5.dll,#1
  2⤵
  PID:440

memory/440-133-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download