190b2582befbcbbbdafac2ba9b8aa038e89fc88102af2e0f4c7002acbaa9d542

Analysis

max time kernel
166s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 23:52

Target

190b2582befbcbbbdafac2ba9b8aa038e89fc88102af2e0f4c7002acbaa9d542.dll
Size

18KB
MD5

e45ea536fab686c9c32742e328d65886
SHA1

7b8f40b3e3d455a70c74263532c914a500dff149
SHA256

190b2582befbcbbbdafac2ba9b8aa038e89fc88102af2e0f4c7002acbaa9d542
SHA512

0ac3de23bcfc0e55352124259f6b263c3bd1e86a8eb6bda7110765a52c14224e94e636bc06d7bdb5227cbd40c8f65bdc334e1645ed02b1c013c688cd15d65ed3
SSDEEP

384:jm/wi+wMa7p2bpDABGlbit4MmtIC5IHS+nxrRCBXstrnxmKz:jmbD7pGfb8HmtR5IHbGBXqnxmK

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/740-133-0x0000000010000000-0x0000000010014000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 740	1620	rundll32.exe	83
PID 1620 wrote to memory of 740	1620	rundll32.exe	83
PID 1620 wrote to memory of 740	1620	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\190b2582befbcbbbdafac2ba9b8aa038e89fc88102af2e0f4c7002acbaa9d542.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\190b2582befbcbbbdafac2ba9b8aa038e89fc88102af2e0f4c7002acbaa9d542.dll,#1
  2⤵
  PID:740

memory/740-133-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download