8503b1357dc05eb88599d3e4ded5b90d350e3477c6870c5eaed5a6ab14421aba

Analysis

max time kernel
140s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 02:15

Target

8503b1357dc05eb88599d3e4ded5b90d350e3477c6870c5eaed5a6ab14421aba.dll
Size

49KB
MD5

92742ba58f8ed5997d17453aa66c5630
SHA1

0a03cf37f1e985adedec8cab9d6c4678fdf9bd84
SHA256

8503b1357dc05eb88599d3e4ded5b90d350e3477c6870c5eaed5a6ab14421aba
SHA512

cb4ce37156bb796f955875c097c73793bc3be97273df65368b2248932d9f05c443990469a2f2b4a4ea501a56214d2d7307f401b3ad94b59752a78409e51e6a87
SSDEEP

768:B9ZTsb9FiaQeMnFxbqAngD1DeU6dGQajeEpYxBDGVWBsgJEhd:JafiaQeSADJxRqDGgsgJgd

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4868-133-0x0000000010000000-0x000000001004A000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 4868	4508	rundll32.exe	80
PID 4508 wrote to memory of 4868	4508	rundll32.exe	80
PID 4508 wrote to memory of 4868	4508	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8503b1357dc05eb88599d3e4ded5b90d350e3477c6870c5eaed5a6ab14421aba.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8503b1357dc05eb88599d3e4ded5b90d350e3477c6870c5eaed5a6ab14421aba.dll,#1
  2⤵
  PID:4868

memory/4868-132-0x0000000000000000-mapping.dmp

Download
memory/4868-133-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download