4b8f419a785a099ced73888a98235ccf800351e6d08945a060880592c132f632

Analysis

max time kernel
204s
max time network
234s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 04:05

Target
4b8f419a785a099ced73888a98235ccf800351e6d08945a060880592c132f632.dll
Size 67KB
Sample221203-enz53sda27
SHA256 4b8f419a785a099ced73888a98235ccf800351e6d08945a060880592c132f632
MD5 5a8258b8fd0563f78eed6aefbc572f25
SHA1 4d2ca97730d3beef2a35ebafefdfd04b6c50e1de
SHA512 95f975e9ee1e36e7da4b6aac8d9d51692d76454ba1b492c4a025404057e5f97a45c86256901357dc76ad5a4f8c04a41592634d246f69ccd7811b4e2531c8740d
SSDEEP 1536:uaqqcO6Ckgpq5aAXKhN8XOIdvVc3l7GkF4SCgHZXd/VgBisA81g:ufqcO6sg5auKhN8+ItVcVqkCTi
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4916-133-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 4916	4252	rundll32.exe	81
PID 4252 wrote to memory of 4916	4252	rundll32.exe	81
PID 4252 wrote to memory of 4916	4252	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b8f419a785a099ced73888a98235ccf800351e6d08945a060880592c132f632.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b8f419a785a099ced73888a98235ccf800351e6d08945a060880592c132f632.dll,#1
  2⤵
  PID:4916

memory/4916-133-0x0000000010000000-0x000000001000D000-memory.dmp

Download