4e45113bdfa91deb6cddf6579f40a2471ce152e3fb4b934ccae1a207a1cad724

Analysis

max time kernel
82s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 08:41

Target

变速精灵2.11免费版/BException.dll
Size

7KB
MD5

00a9f8cc6fb5766e2b303e129d3ca96a
SHA1

52cd862b2c88b90b357fbece693a6d19cff656a7
SHA256

7c6323205b69d6c3f95e1989dac6f7cf4a4aa66625a6b626085caa71372dedf8
SHA512

bef2606d181b0513157d5cdd8855ff6155f1c23b3e9c0d8b67a1f55238f471764a727dcde4e237d5c1da0dcd977cb2f1e91634c592806f02f164757280f07f07
SSDEEP

96:91zQ9iVDjkH0/s68dwJnAc7Tbuxuwb3fmqPQbAHoAxVmTzUuNTnT:9RQefG0/s61JAcTburJIRTzUQT

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3012-133-0x0000000010000000-0x000000001000B000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 3012	3248	rundll32.exe	82
PID 3248 wrote to memory of 3012	3248	rundll32.exe	82
PID 3248 wrote to memory of 3012	3248	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\变速精灵2.11免费版\BException.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\变速精灵2.11免费版\BException.dll,#1
  2⤵
  PID:3012

memory/3012-133-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download