69a59c0f3ea2f40fdd797bbb9ee8c334424d6bfde91b1b6916936f2a87409c27

Analysis

max time kernel
78s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 03:27

Target

69a59c0f3ea2f40fdd797bbb9ee8c334424d6bfde91b1b6916936f2a87409c27.dll
Size

68KB
MD5

5ab084be3b33ae49d434357d22704c0d
SHA1

239606f7289a16e35baff0d21c08ad8d2eba15bd
SHA256

69a59c0f3ea2f40fdd797bbb9ee8c334424d6bfde91b1b6916936f2a87409c27
SHA512

e7fa07e5feb45d390dd9933e2abedc41bea782518805196fbd09006e9f27a992a3117a4f5c919e7c2db4bff20f39eb232af98be3c1a17a0921b1c9b1ccc8934c
SSDEEP

1536:mPO6KEVbsVP0gFd5rn64B7iV37V+HpslcIHrT1bWW2xWKH8LZuATv:cMEVbsVcCb5B7e8Hp4ndqWuGX

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/940-133-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 940	868	rundll32.exe	80
PID 868 wrote to memory of 940	868	rundll32.exe	80
PID 868 wrote to memory of 940	868	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\69a59c0f3ea2f40fdd797bbb9ee8c334424d6bfde91b1b6916936f2a87409c27.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\69a59c0f3ea2f40fdd797bbb9ee8c334424d6bfde91b1b6916936f2a87409c27.dll,#1
  2⤵
  PID:940

memory/940-133-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download