fbf819dd9d42c0952e3e423d3cfd6ae4bba26becba0a9b1f44f05b25af8eefbb

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 10:49

Target

fbf819dd9d42c0952e3e423d3cfd6ae4bba26becba0a9b1f44f05b25af8eefbb.dll
Size

71KB
MD5

668a1294ffcb6826e84154e744fcf6c9
SHA1

3a3e82bae7710d28afffe950811e10ec946c4cc7
SHA256

fbf819dd9d42c0952e3e423d3cfd6ae4bba26becba0a9b1f44f05b25af8eefbb
SHA512

23ded713a701bae770893eb3ba7ee7aa60529c13180985ed2f1b5bbe746754ad741bd464600e1f3e145303032794d8d15309e2f3da74b323bbe0a12defadfabc
SSDEEP

1536:9NKzPzZqrQv7Y659WwqOX7IgFY6KW+vJi5nQ1n:qcrQDfrqOrIOKZx2nOn

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4932-133-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 4932	4300	rundll32.exe	80
PID 4300 wrote to memory of 4932	4300	rundll32.exe	80
PID 4300 wrote to memory of 4932	4300	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbf819dd9d42c0952e3e423d3cfd6ae4bba26becba0a9b1f44f05b25af8eefbb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbf819dd9d42c0952e3e423d3cfd6ae4bba26becba0a9b1f44f05b25af8eefbb.dll,#1
  2⤵
  PID:4932

memory/4932-133-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download