a43572dd5ec406c32b9b42114963a2b6fad0d7a5baa160d580d8c49c42ceeb92

Analysis

max time kernel
186s
max time network
218s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 10:14

Target

a43572dd5ec406c32b9b42114963a2b6fad0d7a5baa160d580d8c49c42ceeb92.dll
Size

216KB
MD5

c762b7744db90ba0ed2a7019f0d0fcee
SHA1

e32a0db357e504ec386f12d923d25381f13f90c3
SHA256

a43572dd5ec406c32b9b42114963a2b6fad0d7a5baa160d580d8c49c42ceeb92
SHA512

e5efe4fd524d0e2b2302b56dd81ab7c966a6292076c0cb6fbc443a0afce683080269e4aa22ce9c2cde8f8c50c4f4f30d0a316381f3f275b34f552531c0c0552a
SSDEEP

384:tmDv+CVrphJmXh+eAsgQLlR6WkopVOm67fbCy6V:ADWCVrAXVCwkomXC

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4764-133-0x0000000010000000-0x0000000010011000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 4764	852	rundll32.exe	79
PID 852 wrote to memory of 4764	852	rundll32.exe	79
PID 852 wrote to memory of 4764	852	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a43572dd5ec406c32b9b42114963a2b6fad0d7a5baa160d580d8c49c42ceeb92.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a43572dd5ec406c32b9b42114963a2b6fad0d7a5baa160d580d8c49c42ceeb92.dll,#1
  2⤵
  PID:4764

memory/4764-133-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download