1f9d2663c5c3cfa4faba28b064612faeacdb74472839dfedf6fc8eb6831a78a5

Analysis

max time kernel
156s
max time network
211s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 20:36

Target

1f9d2663c5c3cfa4faba28b064612faeacdb74472839dfedf6fc8eb6831a78a5.dll
Size

73KB
MD5

dc6b4ace943028899223177befa4f520
SHA1

1b7def8c24be0d219dce7c7717507d1803db767c
SHA256

1f9d2663c5c3cfa4faba28b064612faeacdb74472839dfedf6fc8eb6831a78a5
SHA512

829bbc94006edcc8e66b5b8598b98a0be0b878a2c9bf102619e0ae2951d2eeb0ead92933a8bb7f38e1b0e0e422098ffffcd2f5374556d1b3b8522b54e2fa7ff7
SSDEEP

1536:xdsa99weHD53HleFnYrlAdIq21Ryba3I+w5o9Y2E/gkV6a0/U1/Hm:cMSejR4YRjq21I9+w5oOZV1

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2304-133-0x0000000010000000-0x000000001005E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 2304	1892	rundll32.exe	82
PID 1892 wrote to memory of 2304	1892	rundll32.exe	82
PID 1892 wrote to memory of 2304	1892	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f9d2663c5c3cfa4faba28b064612faeacdb74472839dfedf6fc8eb6831a78a5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f9d2663c5c3cfa4faba28b064612faeacdb74472839dfedf6fc8eb6831a78a5.dll,#1
  2⤵
  PID:2304

memory/2304-132-0x0000000000000000-mapping.dmp

Download
memory/2304-133-0x0000000010000000-0x000000001005E000-memory.dmp

Filesize
376KB

Download