5ffea8ab2a7e2b17fac76567066303523ea61c5079a0fcd6753681bef4dd1c01

Analysis

max time kernel
172s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 00:27

Target

5ffea8ab2a7e2b17fac76567066303523ea61c5079a0fcd6753681bef4dd1c01.dll
Size

70KB
MD5

7a0f74a69477e6c3d1a02c9b78e6af30
SHA1

1f581be8d406fe29590551968ba33d910fd5f028
SHA256

5ffea8ab2a7e2b17fac76567066303523ea61c5079a0fcd6753681bef4dd1c01
SHA512

77233587b5e83a591cad1fa0d846af6d2769713c83d3f9a966676aa3021fdf63c2ac635d6c1c23fdbe86d7dcc2e2789dd93959f8b912c49db6e47ac26fdfeb6c
SSDEEP

1536:Bm1NGJVGDQEWWi7CmoB+cP/PUJisaq7oZVWr3oIw93Bg:kX0VfnWsAwcPEJisNWVtIURg

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4052-133-0x0000000010000000-0x0000000010013000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 4052	2564	rundll32.exe	82
PID 2564 wrote to memory of 4052	2564	rundll32.exe	82
PID 2564 wrote to memory of 4052	2564	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ffea8ab2a7e2b17fac76567066303523ea61c5079a0fcd6753681bef4dd1c01.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ffea8ab2a7e2b17fac76567066303523ea61c5079a0fcd6753681bef4dd1c01.dll,#1
  2⤵
  PID:4052

memory/4052-133-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download