bcb905a71c505d7965841ae7fbccc9d7535405ec69a958650492d78bdf7ce9b0

Analysis

max time kernel
92s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 03:16

Target

bcb905a71c505d7965841ae7fbccc9d7535405ec69a958650492d78bdf7ce9b0.dll
Size

44KB
MD5

5bb3dbe2d7e180f8d3c2523cb70c853e
SHA1

6684579a23460733e821e12eb9ebd2225d9f5d70
SHA256

bcb905a71c505d7965841ae7fbccc9d7535405ec69a958650492d78bdf7ce9b0
SHA512

a83ca7819c68f4231cfc3708dddcf8e8e02454960e047f9cf142430676478c6e9ed7fbd70a7606d7514a2f46a45920e1a1f54b761b673f3927db9abd544c7745
SSDEEP

768:z3OHS8KOzom9bb/XALJ4tOLZord6yNObWAjOwMu0tC0xm28g02n6Orkozo1gv:yHZEmV7w5LZFpagOwMu0ojgN4o8gv

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3108-133-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 3108	1264	rundll32.exe	80
PID 1264 wrote to memory of 3108	1264	rundll32.exe	80
PID 1264 wrote to memory of 3108	1264	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bcb905a71c505d7965841ae7fbccc9d7535405ec69a958650492d78bdf7ce9b0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bcb905a71c505d7965841ae7fbccc9d7535405ec69a958650492d78bdf7ce9b0.dll,#1
  2⤵
  PID:3108

memory/3108-133-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download