74229c5a46750bf414a4a15b48c66116570d772ae0949e5454cbbacac4165d83

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 21:33

Target

74229c5a46750bf414a4a15b48c66116570d772ae0949e5454cbbacac4165d83.dll
Size

72KB
MD5

e688fed53d6db88aa2f2d1dc4cd671c0
SHA1

04abf76ef9fe2f62308d87e261d0661171f1fad6
SHA256

74229c5a46750bf414a4a15b48c66116570d772ae0949e5454cbbacac4165d83
SHA512

e68114d279cd703de773f0bba3a43ef09c529c869237d405d7c899a1d4fefe1b569ad5473d9ac15e39191b9d8cf742f3d069b9b6b08d1654951ce9ece53d3279
SSDEEP

1536:wToxyT1oNr2gw/+eMpTK2LuUewpHfFFEIhmPfylFGa8P74l0LGmLj/hYL:ggq1oNrlxKXw3FZMPfkm/L5LzhYL

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/676-133-0x0000000010000000-0x000000001005B000-memory.dmp	upx
behavioral2/memory/676-134-0x0000000010000000-0x000000001005B000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 676	2088	rundll32.exe	81
PID 2088 wrote to memory of 676	2088	rundll32.exe	81
PID 2088 wrote to memory of 676	2088	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74229c5a46750bf414a4a15b48c66116570d772ae0949e5454cbbacac4165d83.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\74229c5a46750bf414a4a15b48c66116570d772ae0949e5454cbbacac4165d83.dll,#1
  2⤵
  PID:676

memory/676-133-0x0000000010000000-0x000000001005B000-memory.dmp

Filesize
364KB

Download
memory/676-134-0x0000000010000000-0x000000001005B000-memory.dmp

Filesize
364KB

Download