f5011b56e68bd993398d8cd8e95e9dde91e405c4f30f97f4c1dd64f0b06d4c86

Analysis

max time kernel
190s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 22:04

Target

f5011b56e68bd993398d8cd8e95e9dde91e405c4f30f97f4c1dd64f0b06d4c86.dll
Size

4KB
MD5

9b5dff2094ddf1e0f7a97be04351a2f0
SHA1

8f59ca609f490b698998a145c44de30dc1a117f3
SHA256

f5011b56e68bd993398d8cd8e95e9dde91e405c4f30f97f4c1dd64f0b06d4c86
SHA512

3de94d79e8f38cfc4d96db9b4dd424df7efe8848c6c2fd42379abbb8414ce61d2db7e9a6b1be0c5c73586037a145b989c5c9474d1a56fd07f5a4c342a3794863
SSDEEP

48:a5zuMqBcq06phM/wwWLSeJY8JTa6Il+LGGrY9m/mQWZT55pb5sc4FTGcto49/:TRphMzf8tEmOQqj9gY4J

Score

9^/10

upx

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/memory/1840-133-0x0000000075290000-0x0000000075298000-memory.dmp	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1840-133-0x0000000075290000-0x0000000075298000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 1840	4340	rundll32.exe	83
PID 4340 wrote to memory of 1840	4340	rundll32.exe	83
PID 4340 wrote to memory of 1840	4340	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f5011b56e68bd993398d8cd8e95e9dde91e405c4f30f97f4c1dd64f0b06d4c86.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f5011b56e68bd993398d8cd8e95e9dde91e405c4f30f97f4c1dd64f0b06d4c86.dll,#1
  2⤵
  PID:1840

memory/1840-133-0x0000000075290000-0x0000000075298000-memory.dmp

Filesize
32KB

Download