e4aa2589e2fd8c77fc9220d36ec8e78ba674d33c10389bbdc883f157d8982aef

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 00:31

Target

e4aa2589e2fd8c77fc9220d36ec8e78ba674d33c10389bbdc883f157d8982aef.dll
Size

73KB
MD5

8ba65a940f812f416d433bc1e4d818b0
SHA1

b319ae83b6f3097350b6cac76e78a9cdc34db731
SHA256

e4aa2589e2fd8c77fc9220d36ec8e78ba674d33c10389bbdc883f157d8982aef
SHA512

5733b90ce4b92aaab9ec942fdd691d0d055b6959782e9d2dfe73c5f50026c517cb492345fe67103d37c534be5bd796c28750bf35efc83c64114f895efc05a403
SSDEEP

1536:agF0eiyUcbdegnmYolNFav6JHUzcS2rMle45oPOvNosq5aZsKvTlMtOWd0kp6CZY:t2yFBegrolNF06IdVe16NfRsKvKtOUPC

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/5012-133-0x0000000010000000-0x0000000010011000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 5012	4848	rundll32.exe	80
PID 4848 wrote to memory of 5012	4848	rundll32.exe	80
PID 4848 wrote to memory of 5012	4848	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e4aa2589e2fd8c77fc9220d36ec8e78ba674d33c10389bbdc883f157d8982aef.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e4aa2589e2fd8c77fc9220d36ec8e78ba674d33c10389bbdc883f157d8982aef.dll,#1
  2⤵
  PID:5012

memory/5012-133-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download