b0b204b41bfb94d3cd76b4b095b94a706dcc30d6df92ecab6c478949b273a6f3

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 19:23

Target

b0b204b41bfb94d3cd76b4b095b94a706dcc30d6df92ecab6c478949b273a6f3.dll
Size

53KB
MD5

5c37bc6c100c286f651deb83e85614a6
SHA1

d81891941ebbc775bd8bb4f389688a5c7a98d75c
SHA256

b0b204b41bfb94d3cd76b4b095b94a706dcc30d6df92ecab6c478949b273a6f3
SHA512

fda6feca016ef7bdf8d6e345e9383da38da6286ab8af7a1d08a1a2e3726636eeb73ad356edb37098f078725e92a9b807f0d752746e0fa39ae58f44a912ba187b
SSDEEP

768:9xBtKtqyLUkw2+tbTaH8czdkJVw9TQb2X9oLi4bvXXR7ATWIdE5GIUiccfvDVqt9:96w262H8cJQm9LO1YGn00QPqg

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1100-133-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 1100	4344	rundll32.exe	79
PID 4344 wrote to memory of 1100	4344	rundll32.exe	79
PID 4344 wrote to memory of 1100	4344	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b0b204b41bfb94d3cd76b4b095b94a706dcc30d6df92ecab6c478949b273a6f3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b0b204b41bfb94d3cd76b4b095b94a706dcc30d6df92ecab6c478949b273a6f3.dll,#1
  2⤵
  PID:1100

memory/1100-132-0x0000000000000000-mapping.dmp

Download
memory/1100-133-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download