0d14a0e43ec151bc6bfbfd7a0d5f53b90b3522febd5fbea5d9c5dd4038668051

Analysis

max time kernel
152s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 10:55

Target

0d14a0e43ec151bc6bfbfd7a0d5f53b90b3522febd5fbea5d9c5dd4038668051.dll
Size

96KB
MD5

c05e3bdcad997f4883031359debcf9c0
SHA1

b0d8002852fa44ea9d2ed8ebb342102f5d94fdf1
SHA256

0d14a0e43ec151bc6bfbfd7a0d5f53b90b3522febd5fbea5d9c5dd4038668051
SHA512

1cb0f640e51b94380e5d2a98ed00bfdb13f2f025b2e96a062c3ff56a6b4d2226ca2caf408bff7205e5cb3188e7206baff512136f70db18fcb659524905d36b80
SSDEEP

1536:XmMN6PZ4TtvjKo/qiThoHgpcbLSu5iR/RsWNx8i+IHW2D6kOsonrX:XPN6PA1/q4WHgs5c/O28i/22+Zsonr

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4576-133-0x00000000010F0000-0x00000000010FE000-memory.dmp	upx
behavioral2/memory/4576-137-0x00000000010F0000-0x00000000010FE000-memory.dmp	upx
behavioral2/memory/4576-136-0x00000000010F0000-0x00000000010FE000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 4576	2644	rundll32.exe	81
PID 2644 wrote to memory of 4576	2644	rundll32.exe	81
PID 2644 wrote to memory of 4576	2644	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d14a0e43ec151bc6bfbfd7a0d5f53b90b3522febd5fbea5d9c5dd4038668051.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d14a0e43ec151bc6bfbfd7a0d5f53b90b3522febd5fbea5d9c5dd4038668051.dll,#1
  2⤵
  PID:4576

memory/4576-132-0x0000000000000000-mapping.dmp

Download
memory/4576-133-0x00000000010F0000-0x00000000010FE000-memory.dmp

Filesize
56KB

Download
memory/4576-137-0x00000000010F0000-0x00000000010FE000-memory.dmp

Filesize
56KB

Download
memory/4576-136-0x00000000010F0000-0x00000000010FE000-memory.dmp

Filesize
56KB

Download
memory/4576-138-0x00000000010F7000-0x00000000010FD000-memory.dmp

Filesize
24KB

Download
memory/4576-139-0x00000000010F1000-0x00000000010F7000-memory.dmp

Filesize
24KB

Download