f48337243426230dc1a18f76731cf6e05c49bd64326969d980fd491dc78cd0e6

Analysis

max time kernel
61s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 13:56

Target

f48337243426230dc1a18f76731cf6e05c49bd64326969d980fd491dc78cd0e6.dll
Size

238KB
MD5

4d0db34bfa38cfc8479280cb46622906
SHA1

55be91550a8f876360014eca6f5338993f3c489f
SHA256

f48337243426230dc1a18f76731cf6e05c49bd64326969d980fd491dc78cd0e6
SHA512

647c6d0ca9b9c6ad909894a69aa1f2c9fd677f48310e262aff36fe68423e0d012d037c5ba4d732d51b353ea98cae0d57968954e8bd5a1d15c50e89e22222ce8d
SSDEEP

6144:0wJsIZmcvLuairikfB9IiYRMpAcsXlny3j/jnUEZjHNp8O:zZmcqairJ59sCpZsp6nHJtN

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2552-133-0x0000000010000000-0x00000000100A4000-memory.dmp	upx
behavioral2/memory/2552-134-0x0000000010000000-0x00000000100A4000-memory.dmp	upx
behavioral2/memory/2552-135-0x0000000010000000-0x00000000100A4000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2552	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 2552	1560	rundll32.exe	81
PID 1560 wrote to memory of 2552	1560	rundll32.exe	81
PID 1560 wrote to memory of 2552	1560	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f48337243426230dc1a18f76731cf6e05c49bd64326969d980fd491dc78cd0e6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f48337243426230dc1a18f76731cf6e05c49bd64326969d980fd491dc78cd0e6.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2552

memory/2552-133-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download
memory/2552-134-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download
memory/2552-135-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download
memory/2552-136-0x00000000007B0000-0x00000000007EA000-memory.dmp

Filesize
232KB

Download