32e52da929123c915abb58ea4422597bfafd29fb7d8b465d18b729cf759b5491

Analysis

max time kernel
151s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 05:05

Target

32e52da929123c915abb58ea4422597bfafd29fb7d8b465d18b729cf759b5491.dll
Size

4KB
MD5

d5ada84362508f5e5b11b2aaa9e37b00
SHA1

abbe232f1c10b050399c6fb94b142f677f892b9a
SHA256

32e52da929123c915abb58ea4422597bfafd29fb7d8b465d18b729cf759b5491
SHA512

3ef58cb8a6ef057cb2541e122d6d40c814e5868b1a384137a3d9560158c975225b5bf0f4cdbf55dc8ebfa27e7b0c4221d081557646ee4341b80882c76cf22c17
SSDEEP

48:a5zuMqBcq06phM/wwWLSeJY8JTa6Il+LzuDKqWFU9dfitfr1hddPYZNoymbzyT4C:TRphMzf8CuzFqkzddI6rzyTr9yM/L

Score

9^/10

upx

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/memory/1076-133-0x0000000074DE0000-0x0000000074DE8000-memory.dmp	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1076-133-0x0000000074DE0000-0x0000000074DE8000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 1076	1668	rundll32.exe	82
PID 1668 wrote to memory of 1076	1668	rundll32.exe	82
PID 1668 wrote to memory of 1076	1668	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\32e52da929123c915abb58ea4422597bfafd29fb7d8b465d18b729cf759b5491.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\32e52da929123c915abb58ea4422597bfafd29fb7d8b465d18b729cf759b5491.dll,#1
  2⤵
  PID:1076

memory/1076-133-0x0000000074DE0000-0x0000000074DE8000-memory.dmp

Filesize
32KB

Download