9f9e6a085e9ef5c388c7334dcb462fb155271b9b83823d8a5fed82a1ed324ea9

Analysis

max time kernel
179s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 20:37

Target

9f9e6a085e9ef5c388c7334dcb462fb155271b9b83823d8a5fed82a1ed324ea9.dll
Size

54KB
MD5

e7d3b97c322e75d64ce11538565c9dfd
SHA1

9931b0aa18519bafe9cbab527dce30a937961e51
SHA256

9f9e6a085e9ef5c388c7334dcb462fb155271b9b83823d8a5fed82a1ed324ea9
SHA512

2e9a0390684371f6584ab0b247ae8582511d649aba3136e43c820f519d6089465cb3c05e303137cc3e3ee9849d88d1f34400cb5b992c90db81359b30e5ad75f7
SSDEEP

1536:7k876xSRHGRHQSFIh1yH0jKDKNoUqGGOLaNvSp9:o87sSRuwSFIrw3OBf

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3528-133-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3484 wrote to memory of 3528	3484	rundll32.exe	83
PID 3484 wrote to memory of 3528	3484	rundll32.exe	83
PID 3484 wrote to memory of 3528	3484	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f9e6a085e9ef5c388c7334dcb462fb155271b9b83823d8a5fed82a1ed324ea9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f9e6a085e9ef5c388c7334dcb462fb155271b9b83823d8a5fed82a1ed324ea9.dll,#1
  2⤵
  PID:3528

memory/3528-133-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download