c3002bceea85e5e5e62dab846eca835707415abb690262a89ed8c16c38ac1759

Analysis

max time kernel
185s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2022, 02:03

Target

c3002bceea85e5e5e62dab846eca835707415abb690262a89ed8c16c38ac1759.dll
Size

241KB
MD5

e08b4bf80411add1e02d5c6c4b9867c6
SHA1

06b0b911c769109b30b9bd2f0e2b6eb56c63a1d8
SHA256

c3002bceea85e5e5e62dab846eca835707415abb690262a89ed8c16c38ac1759
SHA512

50a94ce529c4a075de57548502fc027587c74ae7786890aee75e7ad780b7ccf09500fca3210578a147edcbafdaaff401882b952ce6573267d625f05526d37c0a
SSDEEP

3072:b/7TJdoZ/23ahAdrTcRQXl6pfqINH+uF+KO2CMshgI/qjDOMtziVZRyzG8s:b/7Pokfx6LfXV/cg/DjtQ6z6

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2252-133-0x0000000000590000-0x00000000005CE000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 2252	3188	rundll32.exe	81
PID 3188 wrote to memory of 2252	3188	rundll32.exe	81
PID 3188 wrote to memory of 2252	3188	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c3002bceea85e5e5e62dab846eca835707415abb690262a89ed8c16c38ac1759.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c3002bceea85e5e5e62dab846eca835707415abb690262a89ed8c16c38ac1759.dll,#1
  2⤵
  PID:2252

memory/2252-133-0x0000000000590000-0x00000000005CE000-memory.dmp

Filesize
248KB

Download