26b863791baa89e89be037ce5d90a9dc4a14412e102ccc8e1d22838ca2f149dd

Analysis

max time kernel
90s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 00:29

Target

26b863791baa89e89be037ce5d90a9dc4a14412e102ccc8e1d22838ca2f149dd.dll
Size

230KB
MD5

b949cc7855916d31686c5d3428ae04cb
SHA1

22abcbd317c32853d3d6008cddf23177a75f4855
SHA256

26b863791baa89e89be037ce5d90a9dc4a14412e102ccc8e1d22838ca2f149dd
SHA512

255a5f818d4a973d37d12bd1624b52bfca3d559a41c0a2b83e7053d494897dd730b743a75cd54957e54c8c1be977d73f68968b9f44e27cfe413a31a58ae61e39
SSDEEP

6144:bSkyR07ioFXP8eubYknnB7TwOIHbeb1oU:bSky8zF/8euUUnhT7IHCbe

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2248-133-0x0000000010000000-0x0000000010088000-memory.dmp	upx
behavioral2/memory/2248-134-0x0000000010000000-0x0000000010088000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2248	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 2248	1808	rundll32.exe	80
PID 1808 wrote to memory of 2248	1808	rundll32.exe	80
PID 1808 wrote to memory of 2248	1808	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\26b863791baa89e89be037ce5d90a9dc4a14412e102ccc8e1d22838ca2f149dd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\26b863791baa89e89be037ce5d90a9dc4a14412e102ccc8e1d22838ca2f149dd.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2248

memory/2248-133-0x0000000010000000-0x0000000010088000-memory.dmp

Filesize
544KB

Download
memory/2248-134-0x0000000010000000-0x0000000010088000-memory.dmp

Filesize
544KB

Download