5514d5cea7b4fd73baf6ebfded0363017cb2ab3589921f5e29e73be595a3b409

Analysis

max time kernel
305s
max time network
350s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 01:30

Target

5514d5cea7b4fd73baf6ebfded0363017cb2ab3589921f5e29e73be595a3b409.dll
Size

4KB
MD5

fe7a8ffde0d9a77b9de993abb98eabd0
SHA1

b1370a599d90afd9c714defcbaa9af291edaf066
SHA256

5514d5cea7b4fd73baf6ebfded0363017cb2ab3589921f5e29e73be595a3b409
SHA512

807c77ffabff1790507c18e186e180d73dc511d4d2f4948130c4bf7e5dd3b7930590acd1022da7f83a17481a515689b68541a32a4050dddb61e67a4412936a01
SSDEEP

48:a5zuMqBcq06phM/wwWLSeJY8JTa6Il+Lngk9Z8X73vTShHzPhmu83t4INSY99Q:TRphMzf8dO73vTShbh3Y9Q

Score

9^/10

upx

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/memory/4588-133-0x0000000074D70000-0x0000000074D78000-memory.dmp	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4588-133-0x0000000074D70000-0x0000000074D78000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 4588	2140	rundll32.exe	80
PID 2140 wrote to memory of 4588	2140	rundll32.exe	80
PID 2140 wrote to memory of 4588	2140	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5514d5cea7b4fd73baf6ebfded0363017cb2ab3589921f5e29e73be595a3b409.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5514d5cea7b4fd73baf6ebfded0363017cb2ab3589921f5e29e73be595a3b409.dll,#1
  2⤵
  PID:4588

memory/4588-133-0x0000000074D70000-0x0000000074D78000-memory.dmp

Filesize
32KB

Download