3ec3ba2d09eef260ff2fd54f586f128ec8b5905e8b236f619985f4a3229a53a3

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 12:34

Target

3ec3ba2d09eef260ff2fd54f586f128ec8b5905e8b236f619985f4a3229a53a3.dll
Size

179KB
MD5

5b05d6a5de62941fabe5358dca1b3fb8
SHA1

6243d98b68a5e7084f6347318626df5c8f7a74c0
SHA256

3ec3ba2d09eef260ff2fd54f586f128ec8b5905e8b236f619985f4a3229a53a3
SHA512

ef8f7b4add6633ee039ae2f2790871b334a7972c5e8473bbcef2f97b112f93cec4e34e30a73b8dc97e75fd8ff8d1787f189166eb2db376d545641981dbd35fd4
SSDEEP

3072:MqgnIfNxkQXnpaWF/Gn+FHZQXEGukhrEmLQhwHvwdG5WOX0AradQhH6CPqb2sGb:Mqxlpaz+FH+0GuqAEQKPAGNFK+CKs0

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/5064-133-0x0000000000400000-0x0000000000479000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 5064	5000	rundll32.exe	83
PID 5000 wrote to memory of 5064	5000	rundll32.exe	83
PID 5000 wrote to memory of 5064	5000	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ec3ba2d09eef260ff2fd54f586f128ec8b5905e8b236f619985f4a3229a53a3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ec3ba2d09eef260ff2fd54f586f128ec8b5905e8b236f619985f4a3229a53a3.dll,#1
  2⤵
  PID:5064

memory/5064-133-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download