985e981a0dfc9590565eae404f35af06b61bb89ddac6a1498e62eb38faa7e22c

Analysis

max time kernel
174s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 01:18

Target

985e981a0dfc9590565eae404f35af06b61bb89ddac6a1498e62eb38faa7e22c.dll
Size

61KB
MD5

b58e211ee7c6fa3a4b9e9de70bccc96d
SHA1

79d5f82874f08e9a7e12dbcb87d276f5b2bb79c9
SHA256

985e981a0dfc9590565eae404f35af06b61bb89ddac6a1498e62eb38faa7e22c
SHA512

08120aeae406c5729073eeb51701d5918c396c7f7867646653d3b7ccd08e01178476992bc1bf8473c579b50026e5156b53a2db5ed3073518bb24b4a0ebc99575
SSDEEP

768:IykIwePd8g7dHQzNiTt0m2+/qpf3+e2MdmSiL+ZIDNnWSst9Qi7utPy9:IykzkaguS0lH2e2Q22I5nzsz97oPC

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2176-133-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2176	1640	rundll32.exe	84
PID 1640 wrote to memory of 2176	1640	rundll32.exe	84
PID 1640 wrote to memory of 2176	1640	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\985e981a0dfc9590565eae404f35af06b61bb89ddac6a1498e62eb38faa7e22c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\985e981a0dfc9590565eae404f35af06b61bb89ddac6a1498e62eb38faa7e22c.dll,#1
  2⤵
  PID:2176

memory/2176-133-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download