cc5ec7d7d554504f73d76efcad99192d0f2b5504280529ff4978f2c651fa269c

Analysis

max time kernel
251s
max time network
326s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 01:48

Target

cc5ec7d7d554504f73d76efcad99192d0f2b5504280529ff4978f2c651fa269c.dll
Size

5KB
MD5

58ae8cadbfdccc93c0db4635da33a260
SHA1

ccb670a68178c16f7ff37fd69df0f4f6796cd0c4
SHA256

cc5ec7d7d554504f73d76efcad99192d0f2b5504280529ff4978f2c651fa269c
SHA512

b0212382dd78286f377f3777114c79d170777e279e67db8ff7ab3258108f2d51a271079a3b5b74b1562445b9287ecf5e45fff47ea8c1aba2c0a4f425b4097d66
SSDEEP

96:we0Ba8nRTVQFXiR0qJku77J6/mOsLF3cI4Ou7:qBHnRxQTu77JOuLF3cCQ

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4032-133-0x0000000010000000-0x000000001000B000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 4032	4436	rundll32.exe	81
PID 4436 wrote to memory of 4032	4436	rundll32.exe	81
PID 4436 wrote to memory of 4032	4436	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc5ec7d7d554504f73d76efcad99192d0f2b5504280529ff4978f2c651fa269c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc5ec7d7d554504f73d76efcad99192d0f2b5504280529ff4978f2c651fa269c.dll,#1
  2⤵
  PID:4032

memory/4032-132-0x0000000000000000-mapping.dmp

Download
memory/4032-133-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download