16301c07b4c20e158a6e8f556b2e70a8b251751493e9b5b517126a30242cc71e

Analysis

max time kernel
203s
max time network
202s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 23:19

Target

16301c07b4c20e158a6e8f556b2e70a8b251751493e9b5b517126a30242cc71e.dll
Size

4KB
MD5

7b537e5404ab2342069cd5ba7d381790
SHA1

7a7b4a9815f7fb490da3270674053ad71438a9d4
SHA256

16301c07b4c20e158a6e8f556b2e70a8b251751493e9b5b517126a30242cc71e
SHA512

bd81113bbac96a2b3e16eff1835cda636f0f9350fffff59e85eec5a1148a2ab0adbe8f57620e67bb3ef33d7661b509c2f366ee99ece705405ba546b3ca2dc175
SSDEEP

48:a5zuMqBcq06phM/wwWLSeJY8JTa6Il+LlHz3z5jYb67WLtmnnceqApqJinecJKwQ:TRphMzf8/Y/iSUQ

Score

9^/10

upx

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/memory/2260-133-0x0000000075600000-0x0000000075608000-memory.dmp	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2260-133-0x0000000075600000-0x0000000075608000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 2260	4264	rundll32.exe	80
PID 4264 wrote to memory of 2260	4264	rundll32.exe	80
PID 4264 wrote to memory of 2260	4264	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\16301c07b4c20e158a6e8f556b2e70a8b251751493e9b5b517126a30242cc71e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\16301c07b4c20e158a6e8f556b2e70a8b251751493e9b5b517126a30242cc71e.dll,#1
  2⤵
  PID:2260

memory/2260-133-0x0000000075600000-0x0000000075608000-memory.dmp

Filesize
32KB

Download