ab81037485220203edbb1a8697836d163aa2caabe8aa8257a8ae00ad25ef2ab4

Analysis

max time kernel
160s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 20:35

Target

ab81037485220203edbb1a8697836d163aa2caabe8aa8257a8ae00ad25ef2ab4.dll
Size

384KB
MD5

c826a760fb5ffd478507f78ebd18ba50
SHA1

ea1fae557fce2e6ce5a66d2339d44d5049c7a2c4
SHA256

ab81037485220203edbb1a8697836d163aa2caabe8aa8257a8ae00ad25ef2ab4
SHA512

b859890111b542e9fdf083b2b265816aec072a587727ee650b6909f13240e51f7e24c3295ef714957940db404af74ac73759360e2709263877c9e69e8734f69a
SSDEEP

3072:cz+JhoaEecYueYFVVA+HvtZDmSrbyHTNRLwZfUi3DfdEfsRzCgM11aZa:u+JhorecYueYFbLyHTLmMi3TGf+211

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1436-133-0x0000000010000000-0x0000000010061000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 1436	4792	rundll32.exe	79
PID 4792 wrote to memory of 1436	4792	rundll32.exe	79
PID 4792 wrote to memory of 1436	4792	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab81037485220203edbb1a8697836d163aa2caabe8aa8257a8ae00ad25ef2ab4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab81037485220203edbb1a8697836d163aa2caabe8aa8257a8ae00ad25ef2ab4.dll,#1
  2⤵
  PID:1436

memory/1436-133-0x0000000010000000-0x0000000010061000-memory.dmp

Filesize
388KB

Download