22080824b2840b47a7f79fff2e811ef3c4f3e3fef1230454ab18aeafebca82f5

Analysis

max time kernel
133s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 19:10

Target

22080824b2840b47a7f79fff2e811ef3c4f3e3fef1230454ab18aeafebca82f5.dll
Size

43KB
MD5

c833165eca96e69845e05af72feff0e0
SHA1

9888c615a3354e5f8da16bd6eabdbe9db26de18e
SHA256

22080824b2840b47a7f79fff2e811ef3c4f3e3fef1230454ab18aeafebca82f5
SHA512

7dc61f2cd582d2746955d152f784a6ef7a63ed961e69a48102d2616d2f89c26573d3daf6c1545a69588e4dbb88580009bc42d6e501dac13559bad03c16187a8b
SSDEEP

768:3oZVZA+BlTM5b9dOTweuSm7v6Yp1vWNGFkwJKB0ijWPb1Cza7V:3oHq+Dmb9teujL7p1vW0+vyjPbH7

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2176-133-0x0000000010000000-0x0000000010040000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 2176	996	rundll32.exe	81
PID 996 wrote to memory of 2176	996	rundll32.exe	81
PID 996 wrote to memory of 2176	996	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\22080824b2840b47a7f79fff2e811ef3c4f3e3fef1230454ab18aeafebca82f5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\22080824b2840b47a7f79fff2e811ef3c4f3e3fef1230454ab18aeafebca82f5.dll,#1
  2⤵
  PID:2176

memory/2176-133-0x0000000010000000-0x0000000010040000-memory.dmp

Filesize
256KB

Download