d48e173b8e355396e3281ec48ad042c4521c4bf6598f0351902abbc1e9e8be9c

Analysis

max time kernel
148s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 10:52

Target

d48e173b8e355396e3281ec48ad042c4521c4bf6598f0351902abbc1e9e8be9c.dll
Size

278KB
MD5

baeaee3788751ec3226ed493b62c0248
SHA1

627fd2a934a5033054abdf5c369e924e74e4e0fc
SHA256

d48e173b8e355396e3281ec48ad042c4521c4bf6598f0351902abbc1e9e8be9c
SHA512

3b4ffd1202ce6a538780b9aff326e41ed06e587faa6aeff1c0fcf844a45585663915d9bfba81fc32aa897585dd4f7ce36191a70212abe5327c31db38e6a74d58
SSDEEP

6144:jVtI4Z1swSSImicdcByPY132zR5DOD7eBhQQ5IVmthnb/d+oEPDE9Z:ptICstIiCY13sDODeQZC+5E9

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1640-133-0x0000000010000000-0x00000000100DB000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 8 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 1640	4112	rundll32.exe	84
PID 4112 wrote to memory of 1640	4112	rundll32.exe	84
PID 4112 wrote to memory of 1640	4112	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d48e173b8e355396e3281ec48ad042c4521c4bf6598f0351902abbc1e9e8be9c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d48e173b8e355396e3281ec48ad042c4521c4bf6598f0351902abbc1e9e8be9c.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1640

memory/1640-133-0x0000000010000000-0x00000000100DB000-memory.dmp

Filesize
876KB

Download