a6c8f71bbbd60cf8a01233a8443533d5186dc0d1774f0948791ab8caa7b88fad

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 13:23

Target

a6c8f71bbbd60cf8a01233a8443533d5186dc0d1774f0948791ab8caa7b88fad.dll
Size

212KB
MD5

0eb45d4110a7dc49448e8efb0bc2e083
SHA1

48c89885c2a19ef4449b942b536ed7cdbc6c296c
SHA256

a6c8f71bbbd60cf8a01233a8443533d5186dc0d1774f0948791ab8caa7b88fad
SHA512

6c0e2eef9a033fe253113fc3e9bd0a7a59bf2a21d7ffe7b21dd55761b7b2c26313bd568d387055f7fb8b724d5f0323ca4eb1a0da83e81116120210a949d33679
SSDEEP

6144:TLr6QBYxWbZHXsSvybSRnp0JTxEFbDyOhC4y:Tr4WbZNvyEuRu7E4

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/744-133-0x0000000000400000-0x0000000000496000-memory.dmp	upx
behavioral2/memory/744-134-0x0000000000400000-0x0000000000496000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 744	3444	rundll32.exe	80
PID 3444 wrote to memory of 744	3444	rundll32.exe	80
PID 3444 wrote to memory of 744	3444	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a6c8f71bbbd60cf8a01233a8443533d5186dc0d1774f0948791ab8caa7b88fad.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a6c8f71bbbd60cf8a01233a8443533d5186dc0d1774f0948791ab8caa7b88fad.dll,#1
  2⤵
  PID:744

memory/744-133-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/744-134-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download