14a68c1f81fa45f88f21dd00e0d42325bfa1a1cd1cab5e7f9d3bbfb80988d018

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 03:09

Target

14a68c1f81fa45f88f21dd00e0d42325bfa1a1cd1cab5e7f9d3bbfb80988d018.dll
Size

68KB
MD5

f4c5c870846e99c3d209695de15629b0
SHA1

5a085a97598968a5b30c5903ee29d438c69f099a
SHA256

14a68c1f81fa45f88f21dd00e0d42325bfa1a1cd1cab5e7f9d3bbfb80988d018
SHA512

70f71f75b21fe1b63e9f45c366abc57d35962575d92444c047fe582b030f302552b2c2ca31e41679ca1699feb36a711dbb19503310940144339281a037e5783a
SSDEEP

1536:n7ZLNPp9pZBM0WSVp+3zrPFOEtDxtMrxrPE/8XIv:7ZppqSVUIE1MVzpYv

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3544-133-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 676 wrote to memory of 3544	676	rundll32.exe	82
PID 676 wrote to memory of 3544	676	rundll32.exe	82
PID 676 wrote to memory of 3544	676	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\14a68c1f81fa45f88f21dd00e0d42325bfa1a1cd1cab5e7f9d3bbfb80988d018.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\14a68c1f81fa45f88f21dd00e0d42325bfa1a1cd1cab5e7f9d3bbfb80988d018.dll,#1
  2⤵
  PID:3544

memory/3544-133-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download