88f1e269b30237ffe606b0b0435e54ebeb48a89e9046107fe438d044c663f620

Analysis

max time kernel
14s
max time network
17s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 12:09

Target

88f1e269b30237ffe606b0b0435e54ebeb48a89e9046107fe438d044c663f620.dll
Size

75KB
MD5

7d3e2ca042e43a5244ad4e7b9d73d990
SHA1

a2feb32e1103923eccd1c8465b1edb4cc071065a
SHA256

88f1e269b30237ffe606b0b0435e54ebeb48a89e9046107fe438d044c663f620
SHA512

6c8ef9f55d81f14e560393e78691a3f0ee4e05c6b1c1094646eb86f603075a4cc2e188a37c01fcf048f5f6cdacb87aa9e8b80217d7d86bddd920baba4d8bc447
SSDEEP

1536:y1AQuwG0EP49TwSfIEH0C2pS4fGQTVJcOrNCXpPnA2wdCOknidQm9t0M:yWQE0gOJPLqfGAbcgNCXpPRfi9j0M

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/832-133-0x0000000000400000-0x0000000000438000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 832	2064	rundll32.exe	76
PID 2064 wrote to memory of 832	2064	rundll32.exe	76
PID 2064 wrote to memory of 832	2064	rundll32.exe	76

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\88f1e269b30237ffe606b0b0435e54ebeb48a89e9046107fe438d044c663f620.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\88f1e269b30237ffe606b0b0435e54ebeb48a89e9046107fe438d044c663f620.dll,#1
  2⤵
  PID:832

memory/832-133-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download