d2a1dece6f52c4fbeba0a67536bccde137dba7f6d4dd6da814e98e4cd0845e42

Analysis

max time kernel
168s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 14:54

Target

d2a1dece6f52c4fbeba0a67536bccde137dba7f6d4dd6da814e98e4cd0845e42.dll
Size

120KB
MD5

3507ae0d5127c13c1b822fdbe7c433bb
SHA1

b957e59c7aeb20b64af30808c52bba0753689b69
SHA256

d2a1dece6f52c4fbeba0a67536bccde137dba7f6d4dd6da814e98e4cd0845e42
SHA512

b829c93f0c99354d55c12b04ce62d7e0afa577d8b2ec304630f9cb9b4352ef429b7c163420b7e94860e5019cf2e2c7f84485b2e3f197023dfdeb6e6d4a004180
SSDEEP

3072:4rhblQwKG4tZ2JTbbnzj/aFSAzY4KuW6l4od:4r024tZ8bDaFNd

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4644-133-0x0000000001370000-0x000000000137D000-memory.dmp	upx
behavioral2/memory/4644-138-0x0000000001370000-0x000000000137D000-memory.dmp	upx
behavioral2/memory/4644-137-0x0000000001370000-0x000000000137D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 4644	4968	rundll32.exe	79
PID 4968 wrote to memory of 4644	4968	rundll32.exe	79
PID 4968 wrote to memory of 4644	4968	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d2a1dece6f52c4fbeba0a67536bccde137dba7f6d4dd6da814e98e4cd0845e42.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d2a1dece6f52c4fbeba0a67536bccde137dba7f6d4dd6da814e98e4cd0845e42.dll,#1
  2⤵
  PID:4644

memory/4644-134-0x0000000001360000-0x0000000001366000-memory.dmp

Filesize
24KB

Download
memory/4644-133-0x0000000001370000-0x000000000137D000-memory.dmp

Filesize
52KB

Download
memory/4644-138-0x0000000001370000-0x000000000137D000-memory.dmp

Filesize
52KB

Download
memory/4644-137-0x0000000001370000-0x000000000137D000-memory.dmp

Filesize
52KB

Download
memory/4644-139-0x0000000001376000-0x000000000137C000-memory.dmp

Filesize
24KB

Download
memory/4644-140-0x0000000001371000-0x0000000001376000-memory.dmp

Filesize
20KB

Download