dc259ef929f3239ca9367e68146f3a2b597dd08c3afe45afd22a267bfae68162

Analysis

max time kernel
90s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 11:16

Target

dc259ef929f3239ca9367e68146f3a2b597dd08c3afe45afd22a267bfae68162.dll
Size

16KB
MD5

5a48fd58d19e1e50939a9bc6e82ee280
SHA1

cbd42ac270089a1aea90565881380099540a0794
SHA256

dc259ef929f3239ca9367e68146f3a2b597dd08c3afe45afd22a267bfae68162
SHA512

c15b1599ac3859694020b79c13b5768e3c8c9cab284a317e3f852172eb6ae45af44ac557b1ba58dd3028252f891efe447cb7c685cedaa433a2be877b3619ff0d
SSDEEP

384:Eg/9m7f9OzuPlMco4F5hAK8gAEOK4/vGzpSAp5Wd:KfAzBco0TAK8dEVSvGzz+

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2296-133-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2296-134-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3392 wrote to memory of 2296	3392	rundll32.exe	80
PID 3392 wrote to memory of 2296	3392	rundll32.exe	80
PID 3392 wrote to memory of 2296	3392	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dc259ef929f3239ca9367e68146f3a2b597dd08c3afe45afd22a267bfae68162.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dc259ef929f3239ca9367e68146f3a2b597dd08c3afe45afd22a267bfae68162.dll,#1
  2⤵
  PID:2296

memory/2296-133-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2296-134-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download