5e5bc67401e07b5c25978ca6137059e5c79b2bf239b214a3b17a224a28e94622

Analysis

max time kernel
163s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 01:28

Target

5e5bc67401e07b5c25978ca6137059e5c79b2bf239b214a3b17a224a28e94622.dll
Size

4KB
MD5

a4abb642e45d26a4ed375cbd2e826650
SHA1

cdaffa148212de5482873fec6adc9aea38cbb2cd
SHA256

5e5bc67401e07b5c25978ca6137059e5c79b2bf239b214a3b17a224a28e94622
SHA512

82effbbc5d1c23beb40fa7aff5280352409ddb00206db5053402320e27cfbfc440adbc4d1c2e0bdaa074620e8d0bf949ed468948aa6430a320c14723468811c7
SSDEEP

48:a5zuMqBcq06phM/wwWLSeJY8JTa6Il+Lyj4uJ18kqzUoxjNuw+iDic:TRphMzf8uj8fzxjNp+iDZ

Score

9^/10

upx

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/memory/4312-133-0x0000000074E10000-0x0000000074E18000-memory.dmp	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4312-133-0x0000000074E10000-0x0000000074E18000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 4312	2004	rundll32.exe	83
PID 2004 wrote to memory of 4312	2004	rundll32.exe	83
PID 2004 wrote to memory of 4312	2004	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e5bc67401e07b5c25978ca6137059e5c79b2bf239b214a3b17a224a28e94622.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e5bc67401e07b5c25978ca6137059e5c79b2bf239b214a3b17a224a28e94622.dll,#1
  2⤵
  PID:4312

memory/4312-133-0x0000000074E10000-0x0000000074E18000-memory.dmp

Filesize
32KB

Download