c76f5b7796afe7d7e907de33ad1f600d6b8f0384b850c09142d0d5a3935b8bb9

Analysis

max time kernel
111s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 06:14

Target

c76f5b7796afe7d7e907de33ad1f600d6b8f0384b850c09142d0d5a3935b8bb9.dll
Size

16KB
MD5

582c87677c8bd24673deeab4a89be950
SHA1

2878d06f1798b2c16948f77e16e8b37fc2579311
SHA256

c76f5b7796afe7d7e907de33ad1f600d6b8f0384b850c09142d0d5a3935b8bb9
SHA512

95542359d1e1cab304c313350b6c411abe7f5da35d7ceb6aa00b4f860c0cb2fec64fb23ce2a1c55b447ccc06221661055ef421192a891bfef2893d7532f6376e
SSDEEP

384:Eg/9m7f9OzuPlMco4F5hAK8gAEOK4/vGzpSApo:KfAzBco0TAK8dEVSvGzzi

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3188-133-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 384 wrote to memory of 3188	384	rundll32.exe	72
PID 384 wrote to memory of 3188	384	rundll32.exe	72
PID 384 wrote to memory of 3188	384	rundll32.exe	72

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c76f5b7796afe7d7e907de33ad1f600d6b8f0384b850c09142d0d5a3935b8bb9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c76f5b7796afe7d7e907de33ad1f600d6b8f0384b850c09142d0d5a3935b8bb9.dll,#1
  2⤵
  PID:3188

memory/3188-132-0x0000000000000000-mapping.dmp

Download
memory/3188-133-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download