ab81037485220203edbb1a8697836d163aa2caabe8aa8257a8ae00ad25ef2ab4

Analysis

max time kernel
160s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 20:35

Target
ab81037485220203edbb1a8697836d163aa2caabe8aa8257a8ae00ad25ef2ab4.dll
Size 384KB
Sample221202-zddjjsfe6w
SHA256 ab81037485220203edbb1a8697836d163aa2caabe8aa8257a8ae00ad25ef2ab4
MD5 c826a760fb5ffd478507f78ebd18ba50
SHA1 ea1fae557fce2e6ce5a66d2339d44d5049c7a2c4
SHA512 b859890111b542e9fdf083b2b265816aec072a587727ee650b6909f13240e51f7e24c3295ef714957940db404af74ac73759360e2709263877c9e69e8734f69a
SSDEEP 3072:cz+JhoaEecYueYFVVA+HvtZDmSrbyHTNRLwZfUi3DfdEfsRzCgM11aZa:u+JhorecYueYFbLyHTLmMi3TGf+211
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1436-133-0x0000000010000000-0x0000000010061000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 1436	4792	rundll32.exe	79
PID 4792 wrote to memory of 1436	4792	rundll32.exe	79
PID 4792 wrote to memory of 1436	4792	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab81037485220203edbb1a8697836d163aa2caabe8aa8257a8ae00ad25ef2ab4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab81037485220203edbb1a8697836d163aa2caabe8aa8257a8ae00ad25ef2ab4.dll,#1
  2⤵
  PID:1436

memory/1436-133-0x0000000010000000-0x0000000010061000-memory.dmp

Download