c1370db3e617fa668c646c4cbe76e5f4788df087043de0c31b4b379dd317c90c

Analysis

max time kernel
101s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 01:05

Target
c1370db3e617fa668c646c4cbe76e5f4788df087043de0c31b4b379dd317c90c.dll
Size 3KB
Sample221206-bfyqhadd65
SHA256 c1370db3e617fa668c646c4cbe76e5f4788df087043de0c31b4b379dd317c90c
MD5 a47efb2907348015f77d6e2b80a5ad30
SHA1 3eb8aa8bc4a54981be8ec5112a92bca9cb316ac7
SHA512 2083af7487e49a6081349862be736a67e3344d176ddcb75ec13e70ae0fa9ad0ed1849790d2f25f5aa6e75d1bde187a0abb88350fb6962fab88f54a7a92d675fe
MD5 SHA1 SHA512

Score

9^/10

upx

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/memory/4540-136-0x0000000075460000-0x0000000075468000-memory.dmp	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4540-136-0x0000000075460000-0x0000000075468000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 4540	4964	rundll32.exe	68
PID 4964 wrote to memory of 4540	4964	rundll32.exe	68
PID 4964 wrote to memory of 4540	4964	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1370db3e617fa668c646c4cbe76e5f4788df087043de0c31b4b379dd317c90c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1370db3e617fa668c646c4cbe76e5f4788df087043de0c31b4b379dd317c90c.dll,#1
  2⤵
  PID:4540

memory/4540-136-0x0000000075460000-0x0000000075468000-memory.dmp

Download