746de24d0bae15ea91f87723f60f54bd8819180eb50010d3025054b8c38f72a2

Analysis

max time kernel
186s
max time network
201s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 09:31

Target

746de24d0bae15ea91f87723f60f54bd8819180eb50010d3025054b8c38f72a2.dll
Size

109KB
MD5

7b91e4439c6d20654603f03519cf6d1d
SHA1

fb66493cf5051d6dedbd1403c4b156f1df8099b7
SHA256

746de24d0bae15ea91f87723f60f54bd8819180eb50010d3025054b8c38f72a2
SHA512

a1541689ce56062dcdb4e032b22754dd896fb1b6464d1e0cb86374144cb4adabcfabfb5a3c7f3d6c0f9dd01c6381e8dc899faf1a4f4bba270ad9e30c44f5837d
SSDEEP

3072:nKBqNGliGdtLiHKiwj2umC4ytsaydl+GO:sWGg+2qiwWhJ8

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2024-133-0x0000000010000000-0x0000000010044000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2024	3060	rundll32.exe	81
PID 3060 wrote to memory of 2024	3060	rundll32.exe	81
PID 3060 wrote to memory of 2024	3060	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\746de24d0bae15ea91f87723f60f54bd8819180eb50010d3025054b8c38f72a2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\746de24d0bae15ea91f87723f60f54bd8819180eb50010d3025054b8c38f72a2.dll,#1
  2⤵
  PID:2024

memory/2024-133-0x0000000010000000-0x0000000010044000-memory.dmp

Filesize
272KB

Download