6bafe66b59a416c4aa0786594c0281480aa7ffeac0e7261a3b821b0463c1d36b

Analysis

max time kernel
182s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 00:22

Target

6bafe66b59a416c4aa0786594c0281480aa7ffeac0e7261a3b821b0463c1d36b.dll
Size

74KB
MD5

8d43814b7f311fcc9e9cfb7a75734100
SHA1

6ec8cb199e08f14999853a5971124e8c9cd583c2
SHA256

6bafe66b59a416c4aa0786594c0281480aa7ffeac0e7261a3b821b0463c1d36b
SHA512

fcd5d6dc011148bf9c4dfd6724a492d90c9bbffbcda3bc511b88dd94b7ce800de1675d3d8360dd9937d2f911f99e23d93a0f93bf6cdd5790756eb04b6a997586
SSDEEP

1536:EK+gsidj6vPO4BQw1d/VDvF5TeM6hAQ+AHuOzLX0Z/0Bxe+PCg:ygsWj6vP3BNz7CJHuOzLU0Bk+PH

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4020-133-0x0000000010000000-0x0000000010662000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 4020	1068	rundll32.exe	79
PID 1068 wrote to memory of 4020	1068	rundll32.exe	79
PID 1068 wrote to memory of 4020	1068	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6bafe66b59a416c4aa0786594c0281480aa7ffeac0e7261a3b821b0463c1d36b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6bafe66b59a416c4aa0786594c0281480aa7ffeac0e7261a3b821b0463c1d36b.dll,#1
  2⤵
  PID:4020

memory/4020-133-0x0000000010000000-0x0000000010662000-memory.dmp

Filesize
6.4MB

Download