12deb491f241f01e75cc3c6e4b8ffe9abf2bfc51419aabe4b6b000f307f20d43

Analysis

max time kernel
90s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 10:46

Target

12deb491f241f01e75cc3c6e4b8ffe9abf2bfc51419aabe4b6b000f307f20d43.dll
Size

107KB
MD5

45aa3a60e2ac4922c17682d414cc3080
SHA1

8f72202b5478b291e15726baf1be1bb4152abf4e
SHA256

12deb491f241f01e75cc3c6e4b8ffe9abf2bfc51419aabe4b6b000f307f20d43
SHA512

b0df0afd0f7e26ab2008389a664eec51f09af0c477caec45d12da56e317b07a6e7e38c088a153be4dbb75d88e9890c8bfa3e5274811d6cb10f2ad58dbd98e4f1
SSDEEP

1536:p/kGi1BMbI88z7Aud7JX0IXZeGtG1Q60IWj7vwsstW3R5ovpCWgYokTIt/iY/J7x:p/kGlQnAi9X0HGCDrj3EW53KBAc

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4760-133-0x0000000075270000-0x000000007529E000-memory.dmp	upx
behavioral2/memory/4760-136-0x0000000075270000-0x000000007529E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 4760	1316	rundll32.exe	82
PID 1316 wrote to memory of 4760	1316	rundll32.exe	82
PID 1316 wrote to memory of 4760	1316	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\12deb491f241f01e75cc3c6e4b8ffe9abf2bfc51419aabe4b6b000f307f20d43.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\12deb491f241f01e75cc3c6e4b8ffe9abf2bfc51419aabe4b6b000f307f20d43.dll,#1
  2⤵
  PID:4760

memory/4760-133-0x0000000075270000-0x000000007529E000-memory.dmp

Filesize
184KB

Download
memory/4760-136-0x0000000075270000-0x000000007529E000-memory.dmp

Filesize
184KB

Download