577369cad8bf2236abda0260afb040513c02aa225663b58e0491a0c7c9354873

Analysis

max time kernel
205s
max time network
222s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 06:15

Target

577369cad8bf2236abda0260afb040513c02aa225663b58e0491a0c7c9354873.dll
Size

16KB
MD5

6e9452f3dfcf1f6ef4d0da7acca23b10
SHA1

9a9482e02f7bf2bb6623efd2541361acfd790231
SHA256

577369cad8bf2236abda0260afb040513c02aa225663b58e0491a0c7c9354873
SHA512

ded76aff38f23fa6bca30cf29a6a2fa949f0b90a4720a5eaf01bd4c13074b3c9ec9d8d04b51ba891384260b1035a942755786cee90ef28cce37e8b3d7ce6aef4
SSDEEP

384:Eg/9m7f9OzuPlMco4F5hAK8gAEOK4/vGzpSApX:KfAzBco0TAK8dEVSvGzz9

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4684-133-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/4684-134-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 4684	4248	rundll32.exe	79
PID 4248 wrote to memory of 4684	4248	rundll32.exe	79
PID 4248 wrote to memory of 4684	4248	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\577369cad8bf2236abda0260afb040513c02aa225663b58e0491a0c7c9354873.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\577369cad8bf2236abda0260afb040513c02aa225663b58e0491a0c7c9354873.dll,#1
  2⤵
  PID:4684

memory/4684-133-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4684-134-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download