9709e2f040919fb7d466e18af5a95348309895e8110ceec5bd6c525a1591c595

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 00:52

Target

9709e2f040919fb7d466e18af5a95348309895e8110ceec5bd6c525a1591c595.dll
Size

58KB
MD5

f20d71ead8a3ac9a23fb6fbc765a80a0
SHA1

e19fc035b493e43fcbeb0af76a5978540cdee030
SHA256

9709e2f040919fb7d466e18af5a95348309895e8110ceec5bd6c525a1591c595
SHA512

9bf31ccb798f8ab217ed1c8162a048c127a9dfcb09f1489897dd7cb62563f8d4a9cc425d047719776fcc3c7372b8438c12b7982a73f2105d9efb51362a98b206
SSDEEP

1536:V2bxnZuYul+sHlIc62KKV3eMH7RriGrJAfr0gPA7:WxnZuYul+glIjV+317xWfggY7

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4172-133-0x0000000010000000-0x000000001000A000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 4172	4972	rundll32.exe	81
PID 4972 wrote to memory of 4172	4972	rundll32.exe	81
PID 4972 wrote to memory of 4172	4972	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9709e2f040919fb7d466e18af5a95348309895e8110ceec5bd6c525a1591c595.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9709e2f040919fb7d466e18af5a95348309895e8110ceec5bd6c525a1591c595.dll,#1
  2⤵
  PID:4172

memory/4172-133-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download