e0bbb26137e9998b5c2901957b8ed6732c7c8ccf5cd14fca8e8c3e6a1c633be7

Analysis

max time kernel
186s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 22:12

Target

e0bbb26137e9998b5c2901957b8ed6732c7c8ccf5cd14fca8e8c3e6a1c633be7.dll
Size

4KB
MD5

b6b8a005064e8d502c11d3dba8738af0
SHA1

e4745b132f0fe740216a90759eee6930ebac8c5f
SHA256

e0bbb26137e9998b5c2901957b8ed6732c7c8ccf5cd14fca8e8c3e6a1c633be7
SHA512

c414d143b0c0324ff7bf02a547d013b30998f2b1afef4cd4dadcd0209d757c84b5e94f318a2834c7dbd8f93f49e8f611f1d49d565e79aa508403ed3ed30485eb
SSDEEP

48:a5zuMqBcq06phM/wwWLSeJY8JTa6Il+Ln4iD7pElRaAPEOpUzPhn37Yzt25kYuto:TRphMzf8n4U7KMCEOaLi+kYfQ5pnzA

Score

9^/10

upx

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/memory/1348-133-0x0000000075550000-0x0000000075558000-memory.dmp	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1348-133-0x0000000075550000-0x0000000075558000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 1348	5112	rundll32.exe	83
PID 5112 wrote to memory of 1348	5112	rundll32.exe	83
PID 5112 wrote to memory of 1348	5112	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e0bbb26137e9998b5c2901957b8ed6732c7c8ccf5cd14fca8e8c3e6a1c633be7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e0bbb26137e9998b5c2901957b8ed6732c7c8ccf5cd14fca8e8c3e6a1c633be7.dll,#1
  2⤵
  PID:1348

memory/1348-133-0x0000000075550000-0x0000000075558000-memory.dmp

Filesize
32KB

Download