2231a8fd6d1976ddbdbf2cd5c031b8077205fe22d4d9aa3e1fc83eccd66d842a

Analysis

max time kernel
153s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 19:08

Target

2231a8fd6d1976ddbdbf2cd5c031b8077205fe22d4d9aa3e1fc83eccd66d842a.dll
Size

45KB
MD5

3ef97d997151aab17f0a75f978dd4d90
SHA1

0156e8e2bcab7e8872fa87f2a25383bb1109f5ac
SHA256

2231a8fd6d1976ddbdbf2cd5c031b8077205fe22d4d9aa3e1fc83eccd66d842a
SHA512

c0759b52c20ae5011d1080e6ee4bf639c84c6f6f9820856a7baaf1092b94cd8061374a6047516be96bfef505b264f0174f4acafd5339291b32a0e2385cab6440
SSDEEP

768:vW+anfMF6h6q3LUThFU5Ho6QZhI5G1jl7JLGEtWbVlegOobagMF7BErqnlzTMTjD:vFanfonWuA5I6QIcXaEgZvOougMFyrq+

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1492-133-0x0000000010000000-0x0000000010046000-memory.dmp	upx
behavioral2/memory/1492-134-0x0000000010000000-0x0000000010046000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 1492	780	rundll32.exe	81
PID 780 wrote to memory of 1492	780	rundll32.exe	81
PID 780 wrote to memory of 1492	780	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2231a8fd6d1976ddbdbf2cd5c031b8077205fe22d4d9aa3e1fc83eccd66d842a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2231a8fd6d1976ddbdbf2cd5c031b8077205fe22d4d9aa3e1fc83eccd66d842a.dll,#1
  2⤵
  PID:1492

memory/1492-133-0x0000000010000000-0x0000000010046000-memory.dmp

Filesize
280KB

Download
memory/1492-134-0x0000000010000000-0x0000000010046000-memory.dmp

Filesize
280KB

Download