5fc6527dee1149f3ceabaf97539c2a65d26e88427996920b6efa8ae4f870ee61

Analysis

max time kernel
75s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 03:08

Target

5fc6527dee1149f3ceabaf97539c2a65d26e88427996920b6efa8ae4f870ee61.dll
Size

74KB
MD5

f10451a927bb5d6ed5d7e583866d2a20
SHA1

16885efeabf4206efaebd85b346ebb479ca13e32
SHA256

5fc6527dee1149f3ceabaf97539c2a65d26e88427996920b6efa8ae4f870ee61
SHA512

79c5f00fe70e9cdb8f641260a50d9c6bd8add8a9ac76d06ab1b3d9156f6e2da79715102223ae18e96452a4a634a85f1b944ed33573b47f94d027980a737d0871
SSDEEP

1536:n7ZLNPp9pZBMNp13p+IZU7RdDPs8wTqcmLEQd41Ivg4wFktvg6bMP:7ZppiphGhEovQQdrI40Uv6P

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4728-133-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3484 wrote to memory of 4728	3484	rundll32.exe	80
PID 3484 wrote to memory of 4728	3484	rundll32.exe	80
PID 3484 wrote to memory of 4728	3484	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5fc6527dee1149f3ceabaf97539c2a65d26e88427996920b6efa8ae4f870ee61.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5fc6527dee1149f3ceabaf97539c2a65d26e88427996920b6efa8ae4f870ee61.dll,#1
  2⤵
  PID:4728

memory/4728-133-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download