77126d15c6e0449bc436216a08d7aea976c0a28c5750aad71986ef80fb8aa13f

Analysis

max time kernel
91s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 18:42

Target

77126d15c6e0449bc436216a08d7aea976c0a28c5750aad71986ef80fb8aa13f.dll
Size

114KB
MD5

ed824015707b3609ca917b4411a93c6c
SHA1

d3e7344cd7e22a2b7069e340facc086a4faa149a
SHA256

77126d15c6e0449bc436216a08d7aea976c0a28c5750aad71986ef80fb8aa13f
SHA512

2f5e9a8ea4857a797e940b05b7ac9e91beaf1e8ee08ecf15796102219d6746f5be42b5425d041ae31ee2042067ee26385e30f4f885b2a392de7cd2c10bd7f4c9
SSDEEP

3072:gfG1v4Ug1BzTQBQwUV9/jYaxO1bHToxaTxX:5gbTQBQHH/jY31bzeo

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3052-133-0x0000000000400000-0x0000000000453000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 3052	4684	rundll32.exe	78
PID 4684 wrote to memory of 3052	4684	rundll32.exe	78
PID 4684 wrote to memory of 3052	4684	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\77126d15c6e0449bc436216a08d7aea976c0a28c5750aad71986ef80fb8aa13f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\77126d15c6e0449bc436216a08d7aea976c0a28c5750aad71986ef80fb8aa13f.dll,#1
  2⤵
  PID:3052

memory/3052-133-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download