9a2f65bed62fd10860cdcfbb99750878b452fdfc1da0edb410a19ce83dc8ecbe

Analysis

max time kernel
68s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2022 02:04

Target

9a2f65bed62fd10860cdcfbb99750878b452fdfc1da0edb410a19ce83dc8ecbe.dll
Size

56KB
MD5

b21f41b3d8ead7da6b1661504bcb871e
SHA1

39599c3da2d0e4df79b06f8c403358ee72c50994
SHA256

9a2f65bed62fd10860cdcfbb99750878b452fdfc1da0edb410a19ce83dc8ecbe
SHA512

a30cebc967644871c3bac9a73e2c1d4850d763554c12e9efa99e851cd8523ba74f120cfc71f5fa34b0e94839860ce71679a1a1240acbee73ea6ca5ed4f228409
SSDEEP

1536:SQWXmSl7chRII8vBI5RbCrNGGgYBScinqoXP3G4N:6DlwhWtBI5RkGM0

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1804-133-0x0000000021870000-0x000000002189B000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 1804	4908	rundll32.exe	83
PID 4908 wrote to memory of 1804	4908	rundll32.exe	83
PID 4908 wrote to memory of 1804	4908	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a2f65bed62fd10860cdcfbb99750878b452fdfc1da0edb410a19ce83dc8ecbe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a2f65bed62fd10860cdcfbb99750878b452fdfc1da0edb410a19ce83dc8ecbe.dll,#1
  2⤵
  PID:1804

memory/1804-133-0x0000000021870000-0x000000002189B000-memory.dmp

Filesize
172KB

Download