b83c877ff4957137eec737a5522bb7141196cd238d379d64e1812040a0d1aaec

Analysis

max time kernel
186s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 02:00

Target

b83c877ff4957137eec737a5522bb7141196cd238d379d64e1812040a0d1aaec.dll
Size

4KB
MD5

94492a08de4db94e802340f0ce3be3e0
SHA1

17334177a18e39d6edbe1e74fe9cf7819e7b0ea1
SHA256

b83c877ff4957137eec737a5522bb7141196cd238d379d64e1812040a0d1aaec
SHA512

63314d60821f3f3f433b86d7aebb7f1de68e58c2de00bbc311f66a82168cc33583a85583003d495918009872975b9395b12898cd72f349a60fa98c65650841cb
SSDEEP

48:a5zuMqBcq06phM/wwWLSeJY8JTa6Il+LH9gLnki82wHSyibw65C2DRrlv3Sb/TWz:TRphMzf8qT2RSyi8gC2lZO/KmQ

Score

9^/10

upx

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/memory/2932-133-0x0000000075600000-0x0000000075608000-memory.dmp	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2932-133-0x0000000075600000-0x0000000075608000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 2932	4592	rundll32.exe	52
PID 4592 wrote to memory of 2932	4592	rundll32.exe	52
PID 4592 wrote to memory of 2932	4592	rundll32.exe	52

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b83c877ff4957137eec737a5522bb7141196cd238d379d64e1812040a0d1aaec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b83c877ff4957137eec737a5522bb7141196cd238d379d64e1812040a0d1aaec.dll,#1
  2⤵
  PID:2932

memory/2932-133-0x0000000075600000-0x0000000075608000-memory.dmp

Filesize
32KB

Download