b259ae8df6f050d336cd3dd3e9b9b0a4167e1ce843cd11f0227bce4719f99b78

Analysis

max time kernel
160s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 13:59

Target

b259ae8df6f050d336cd3dd3e9b9b0a4167e1ce843cd11f0227bce4719f99b78.dll
Size

91KB
MD5

54537be30cf94dc682480b520a2ea860
SHA1

0e4a6811752ca0766bb13c3df117577edffaa236
SHA256

b259ae8df6f050d336cd3dd3e9b9b0a4167e1ce843cd11f0227bce4719f99b78
SHA512

af581c005d8736c77511e006ff0377bcb70a6ab639b0d10df5e5b0f732381d69893d4a791c6608c6c253bb1efc0218192705a4a29c49a376a2597418eb52da4c
SSDEEP

1536:2g3XHo8H4rUmQwjaGL7NL1IkkDh5tQpbtuU4jPSaUOnEZ+mwgp6viFXoSMOV67ns:pnI8H4YmQnGL7NL13ShQWVfE/w9viiSN

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/5064-133-0x0000000010000000-0x000000001002A000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5064	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 5064	2344	rundll32.exe	80
PID 2344 wrote to memory of 5064	2344	rundll32.exe	80
PID 2344 wrote to memory of 5064	2344	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b259ae8df6f050d336cd3dd3e9b9b0a4167e1ce843cd11f0227bce4719f99b78.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b259ae8df6f050d336cd3dd3e9b9b0a4167e1ce843cd11f0227bce4719f99b78.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5064

memory/5064-133-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download
memory/5064-134-0x0000000000590000-0x0000000000598000-memory.dmp

Filesize
32KB

Download
memory/5064-135-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download
memory/5064-138-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download