6aa76d4bdb84a7b3b602e287d149e6238ab2efe575ddfc63d3d6ad9262f28758

Analysis

max time kernel
92s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 14:06

Target
6aa76d4bdb84a7b3b602e287d149e6238ab2efe575ddfc63d3d6ad9262f28758.dll
Size 67KB
Sample221204-regctsae8t
SHA256 6aa76d4bdb84a7b3b602e287d149e6238ab2efe575ddfc63d3d6ad9262f28758
MD5 8c54a33d97d9edf9c8455400c9788220
SHA1 b983100d0de572b39057ce2d31328910111de85a
SHA512 b95bb0dac65a02412a6906114a29550da5f4f89f689ea21fc42c41aa33e4f46a87bba85edf785d6a3e8064fe0708b77c60fbeb59c44bc914d65b125333087e2b
SSDEEP 1536:8nrxDussGn4AAejPC7Mp/c+HJgKKtLhVuDvRPn:y6tV0pk+pgRLPuD5n
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1556-133-0x0000000000400000-0x0000000000431000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 1556	2736	rundll32.exe	79
PID 2736 wrote to memory of 1556	2736	rundll32.exe	79
PID 2736 wrote to memory of 1556	2736	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6aa76d4bdb84a7b3b602e287d149e6238ab2efe575ddfc63d3d6ad9262f28758.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6aa76d4bdb84a7b3b602e287d149e6238ab2efe575ddfc63d3d6ad9262f28758.dll,#1
  2⤵
  PID:1556

memory/1556-133-0x0000000000400000-0x0000000000431000-memory.dmp

Download