6bf913dd582c246b7fcc0e7f075d86c345d9ee7df311994c1a6d5941f156b8d1

Analysis

max time kernel
195s
max time network
200s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 19:29

Target

6bf913dd582c246b7fcc0e7f075d86c345d9ee7df311994c1a6d5941f156b8d1.dll
Size

62KB
MD5

741460eabbf08a5e8ad50f61794883b0
SHA1

5b89de13a324cd3dae750bfa4d1716f5acbdf5d2
SHA256

6bf913dd582c246b7fcc0e7f075d86c345d9ee7df311994c1a6d5941f156b8d1
SHA512

ef86f04de87cc7f50c697dd05051ea33f370ea28757b18b0087cf233c2400372130144692917433a83d562f9800329c6bc8876b7bb645b17b59ae34c1fbf3c14
SSDEEP

1536:O/S0tJ5FMUzxs2nj6U0Sawyw1v+MTaxusFEZ8T:O/S0JFMUzOC7z1lZTtsiZG

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2384-133-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 2384	4988	rundll32.exe	80
PID 4988 wrote to memory of 2384	4988	rundll32.exe	80
PID 4988 wrote to memory of 2384	4988	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6bf913dd582c246b7fcc0e7f075d86c345d9ee7df311994c1a6d5941f156b8d1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6bf913dd582c246b7fcc0e7f075d86c345d9ee7df311994c1a6d5941f156b8d1.dll,#1
  2⤵
  PID:2384

memory/2384-133-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download