1fb00666274834081b796f78d858de9a4a607aa139113bfb8dfde4f58725b0d1

Analysis

max time kernel
95s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 10:27

Target

1fb00666274834081b796f78d858de9a4a607aa139113bfb8dfde4f58725b0d1.dll
Size

38KB
MD5

e4c5849c4608e866f36f755b922352d0
SHA1

958cff244c5300bf62db6d34fdbfec650f89e244
SHA256

1fb00666274834081b796f78d858de9a4a607aa139113bfb8dfde4f58725b0d1
SHA512

b6739be3c6c679b3d97d7487c533157f3d1c5912a53900427f11c4b5f53a22e29f2cb884ec7ba0f0f224a9c3b8bd719671f2ff9fcd825a37967a5280b6de44c4
SSDEEP

768:szM2xVVgoO2/zhiorQHUaj8chDaeN5Zd0JcVkn3ZLk6Vp:V2b1rOlZhTN5ZqCVknJLkWp

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1496-133-0x0000000010000000-0x000000001000A000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 1496	3992	rundll32.exe	79
PID 3992 wrote to memory of 1496	3992	rundll32.exe	79
PID 3992 wrote to memory of 1496	3992	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1fb00666274834081b796f78d858de9a4a607aa139113bfb8dfde4f58725b0d1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1fb00666274834081b796f78d858de9a4a607aa139113bfb8dfde4f58725b0d1.dll,#1
  2⤵
  PID:1496

memory/1496-133-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download