9c646cad5e40772f5627ca2bae6fce1d771a78b7e6df4af3a2e434845d874160

Analysis

max time kernel
92s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 01:13

Target
9c646cad5e40772f5627ca2bae6fce1d771a78b7e6df4af3a2e434845d874160.dll
Size 4KB
Sample221206-blke3agg6v
SHA256 9c646cad5e40772f5627ca2bae6fce1d771a78b7e6df4af3a2e434845d874160
MD5 56320a664ff3b9ccd5596c0ffde575b0
SHA1 9c6c0cd1300019e204e4b5613349edffd7bd50f8
SHA512 75670efcbd176b57b27fe0732e2d136228a4837ae436213c17ad4e18554fdd32e65e9d7eac21f2838ddac9756dbbf6f3ecbb2fe669b5d625d4c57527a80fb8db
SSDEEP 48:a5zuMqBcq06phM/wwWLSeJY8JTa6Il+LGKuIjBNoH30IJEjk3UwH7q14Ab9x/0aX:TRphMzf8VjgHEIJF3UwHe+2x/e5xQ
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

upx

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/memory/1636-133-0x0000000074DB0000-0x0000000074DB8000-memory.dmp	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1636-133-0x0000000074DB0000-0x0000000074DB8000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 988 wrote to memory of 1636	988	rundll32.exe	80
PID 988 wrote to memory of 1636	988	rundll32.exe	80
PID 988 wrote to memory of 1636	988	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9c646cad5e40772f5627ca2bae6fce1d771a78b7e6df4af3a2e434845d874160.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9c646cad5e40772f5627ca2bae6fce1d771a78b7e6df4af3a2e434845d874160.dll,#1
  2⤵
  PID:1636

memory/1636-133-0x0000000074DB0000-0x0000000074DB8000-memory.dmp

Download