5c1938b66e479ef53c8601eec28b0cf905374c922fa7a05a1d76203b9921b992

Analysis

max time kernel
152s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 20:49

Target

5c1938b66e479ef53c8601eec28b0cf905374c922fa7a05a1d76203b9921b992.dll
Size

113KB
MD5

1cd48ca07e03ca4dd9b2a7075048c238
SHA1

44d70f9fd7431b0d8c6b2abced3ecec6e04d5c83
SHA256

5c1938b66e479ef53c8601eec28b0cf905374c922fa7a05a1d76203b9921b992
SHA512

9707108a0de75f58e31600e423a4e6a86f6d8e79a252acd9eee0de0575eaa3e49f269d4d51de8d7cfa09e3448dfe49d6d0ac2f997b60e3f3fc7065c60bd39a4e
SSDEEP

1536:T8b0zyJO5R1fGyPk8zS6lglv9xs+YuVfJfQViw1jkt5PY3P6d5sXmbHDK9hqdj6U:T8Ns5HuaKlAihQ5jcxgP6b9bjK2gNz

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1548-133-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/1548-134-0x0000000000400000-0x0000000000453000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 1548	2816	rundll32.exe	82
PID 2816 wrote to memory of 1548	2816	rundll32.exe	82
PID 2816 wrote to memory of 1548	2816	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c1938b66e479ef53c8601eec28b0cf905374c922fa7a05a1d76203b9921b992.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c1938b66e479ef53c8601eec28b0cf905374c922fa7a05a1d76203b9921b992.dll,#1
  2⤵
  PID:1548

memory/1548-133-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1548-134-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download