a4478cce10fe6e1e5aa8baf2f8676d9f074fcbb75d5405123de290298c2f34b1

Analysis

max time kernel
173s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 03:13

Target

a4478cce10fe6e1e5aa8baf2f8676d9f074fcbb75d5405123de290298c2f34b1.dll
Size

73KB
MD5

5cef3614c3eb6e0c57686eeaf28ce8b8
SHA1

1a46f9ed26bf482e0c0c1beecd1ad9bd5be5e19b
SHA256

a4478cce10fe6e1e5aa8baf2f8676d9f074fcbb75d5405123de290298c2f34b1
SHA512

83e8a53fbbff14ce0e33e552ee5d4be99bbe5350f2df83eccc2067f54c84a0f115c0707b23158d37e4e690be406542ab7cfe8efc2987cef04f8d4421e59ff504
SSDEEP

1536:Bm1NGJVGMlCaSVrC9P2SjGRxE/VxomKtzbqtwmp6CuLlZTy:kX0VCzVG9O1Rxk/gpqtzp3up8

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4460-133-0x0000000010000000-0x0000000010013000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 4460	4432	rundll32.exe	82
PID 4432 wrote to memory of 4460	4432	rundll32.exe	82
PID 4432 wrote to memory of 4460	4432	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4478cce10fe6e1e5aa8baf2f8676d9f074fcbb75d5405123de290298c2f34b1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4478cce10fe6e1e5aa8baf2f8676d9f074fcbb75d5405123de290298c2f34b1.dll,#1
  2⤵
  PID:4460

memory/4460-133-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download