9066086db0cad6e234148596f3aae973abab29af57fd89b11e79e367c6ee9556

Analysis

max time kernel
146s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 03:35

Target

9066086db0cad6e234148596f3aae973abab29af57fd89b11e79e367c6ee9556.dll
Size

64KB
MD5

fd857b9f7291ae3d79994c598a672a55
SHA1

850ed381b25456815e1ef98761fdbbf69ce758ab
SHA256

9066086db0cad6e234148596f3aae973abab29af57fd89b11e79e367c6ee9556
SHA512

0efa1f165882a6f43a707219c16696cdefabeec04db046d92601d4d1fdc33742c294908b51c5947e92a6cb4a1c3372285b731baabf7a1fad9097a75488070897
SSDEEP

1536:RVFAfiGebDBf2P2TO5mN6R4lhqNppmXh0iIBqC:Tyf9ebc+T0P4lhqNppahIBR

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/204-133-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 204	4328	rundll32.exe	83
PID 4328 wrote to memory of 204	4328	rundll32.exe	83
PID 4328 wrote to memory of 204	4328	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9066086db0cad6e234148596f3aae973abab29af57fd89b11e79e367c6ee9556.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9066086db0cad6e234148596f3aae973abab29af57fd89b11e79e367c6ee9556.dll,#1
  2⤵
  PID:204

memory/204-133-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download