9395316c2297f6234e3fcabbdc60983fc25ac8146ca1e2885fb3414c8369b700

Analysis

max time kernel
90s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 00:37

Target

9395316c2297f6234e3fcabbdc60983fc25ac8146ca1e2885fb3414c8369b700.dll
Size

144KB
MD5

f28e91fc91afd9b1606549aa33d38ec7
SHA1

e9f839e835ee14290532953abf12eb59253df195
SHA256

9395316c2297f6234e3fcabbdc60983fc25ac8146ca1e2885fb3414c8369b700
SHA512

4d9748c61c7f073f3c2d2d1a2502673385432e0ede5a206306d7d91cece3cd58b6db0e0fe33b401d5e4795eb24c7a30858eaf817a38238b670397efb5ec80f02
SSDEEP

3072:GGM8cmrYaCCTcoiF8Yat7PsPCrUyG8wrrlxOcB:GGM8J0ic9F8Yk7kJyE3ZB

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2280-133-0x0000000000780000-0x000000000078D000-memory.dmp	upx
behavioral2/memory/2280-136-0x0000000000780000-0x000000000078D000-memory.dmp	upx
behavioral2/memory/2280-137-0x0000000000780000-0x000000000078D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 2280	4752	rundll32.exe	82
PID 4752 wrote to memory of 2280	4752	rundll32.exe	82
PID 4752 wrote to memory of 2280	4752	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9395316c2297f6234e3fcabbdc60983fc25ac8146ca1e2885fb3414c8369b700.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9395316c2297f6234e3fcabbdc60983fc25ac8146ca1e2885fb3414c8369b700.dll,#1
  2⤵
  PID:2280

memory/2280-133-0x0000000000780000-0x000000000078D000-memory.dmp

Filesize
52KB

Download
memory/2280-136-0x0000000000780000-0x000000000078D000-memory.dmp

Filesize
52KB

Download
memory/2280-137-0x0000000000780000-0x000000000078D000-memory.dmp

Filesize
52KB

Download
memory/2280-139-0x0000000000781000-0x0000000000787000-memory.dmp

Filesize
24KB

Download
memory/2280-138-0x0000000000787000-0x000000000078C000-memory.dmp

Filesize
20KB

Download