89dd6176c382f43c3c081bd7accd3843026d4cdb158f2f0c809c07d97064b0b2

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 04:49

Target

89dd6176c382f43c3c081bd7accd3843026d4cdb158f2f0c809c07d97064b0b2.dll
Size

4KB
MD5

e466bc6e3ebbe7786d67ab023b074800
SHA1

85d6b6e91bf2703cd31191bff0c11e2f4e392fa0
SHA256

89dd6176c382f43c3c081bd7accd3843026d4cdb158f2f0c809c07d97064b0b2
SHA512

c7b35472c3514653bb511d3eb987c25c7ce83cfbc525e6dbc1404d2603367c17a6e74b9a608cb7b9374a78e9da166e201c18654a5d3924bb132822d964814d9e
SSDEEP

48:a5zuMqBcq06phM/wwWLSeJY8JTa6Il+L4+yIUW/eIocxOZoKURBNZJNFfHF:TRphMzf86IUaOefHF

Score

9^/10

upx

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/memory/1316-133-0x0000000075910000-0x0000000075918000-memory.dmp	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1316-133-0x0000000075910000-0x0000000075918000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 1316	2232	rundll32.exe	83
PID 2232 wrote to memory of 1316	2232	rundll32.exe	83
PID 2232 wrote to memory of 1316	2232	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\89dd6176c382f43c3c081bd7accd3843026d4cdb158f2f0c809c07d97064b0b2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\89dd6176c382f43c3c081bd7accd3843026d4cdb158f2f0c809c07d97064b0b2.dll,#1
  2⤵
  PID:1316

memory/1316-133-0x0000000075910000-0x0000000075918000-memory.dmp

Filesize
32KB

Download