435d51cacb6bd9222d3165df22c2306e072403f0765a6f57224ab5a732305ae0 | Triage

Analysis

max time kernel
91s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
15-06-2022 00:51

Sharing

Report Analysis Logs

General

Target

435d51cacb6bd9222d3165df22c2306e072403f0765a6f57224ab5a732305ae0.dll
Size

199KB
MD5

2bd1db3a5357dcf620bf979eee24d073
SHA1

089424f4975b51b4f549ca7c261f553da3aa0a8d
SHA256

435d51cacb6bd9222d3165df22c2306e072403f0765a6f57224ab5a732305ae0
SHA512

f009d9feb6cc4e2eb96f410b86cd8fb78b865e25d600172a613c11bdb0f484f0bb549d8daf0656330923f8bca79f7b5aa8bc11692e4e62e1b4c78a746d084a40

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/3144-131-0x0000000000400000-0x000000000044C000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1608 3144 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2432 wrote to memory of 3144	2432	rundll32.exe	rundll32.exe
PID 2432 wrote to memory of 3144	2432	rundll32.exe	rundll32.exe
PID 2432 wrote to memory of 3144	2432	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\435d51cacb6bd9222d3165df22c2306e072403f0765a6f57224ab5a732305ae0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2432

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\435d51cacb6bd9222d3165df22c2306e072403f0765a6f57224ab5a732305ae0.dll,#1
2⤵
PID:3144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 568
3⤵
- Program crash
PID:1608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 3144 -ip 3144
1⤵
PID:4064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3144-130-0x0000000000000000-mapping.dmp

Download
memory/3144-131-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3144-132-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download