a4e83d33e6defddc734c87db09af856d9283c2204f49861b359a5d5f36e10069

Analysis

max time kernel
174s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 08:39

Target

a4e83d33e6defddc734c87db09af856d9283c2204f49861b359a5d5f36e10069.dll
Size

209KB
MD5

9abb7ae1048b69a8e27c424751f5cf5b
SHA1

aa5db3621fd9b4323728bae65efed6bcf8eb619c
SHA256

a4e83d33e6defddc734c87db09af856d9283c2204f49861b359a5d5f36e10069
SHA512

7cc8de394ee87e1ce5ae6b165bc055b5846da803ca310af02fd9e22f87fa15df888d29b8a3c3be26e906a7d3f921d652f03e4c969a962bb3806243b71839ae2b
SSDEEP

3072:xdedG8p3BsSA/E2YhDQ6VEShGkVZnYQf58Xy2nb7OYB5BhIqsLhi6:xSJ0EDs6fkksQhK7OYB5B

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4480-133-0x0000000001ED0000-0x0000000001F5F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 4480	4956	rundll32.exe	83
PID 4956 wrote to memory of 4480	4956	rundll32.exe	83
PID 4956 wrote to memory of 4480	4956	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4e83d33e6defddc734c87db09af856d9283c2204f49861b359a5d5f36e10069.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4e83d33e6defddc734c87db09af856d9283c2204f49861b359a5d5f36e10069.dll,#1
  2⤵
  PID:4480

memory/4480-132-0x0000000000000000-mapping.dmp

Download
memory/4480-133-0x0000000001ED0000-0x0000000001F5F000-memory.dmp

Filesize
572KB

Download