e8f64fe165abbb104d725b5f00b6fcafbc584df3f55c7468814b08bf68eb8941 | Triage

Analysis

max time kernel
138s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2022 21:11

Sharing

Report Analysis Logs

General

Target

e8f64fe165abbb104d725b5f00b6fcafbc584df3f55c7468814b08bf68eb8941.dll
Size

3KB
MD5

66664fa33baed7b821130ec78280eab0
SHA1

44f88ac8e7fe0bebaa6ae5c102f09227f38af7db
SHA256

e8f64fe165abbb104d725b5f00b6fcafbc584df3f55c7468814b08bf68eb8941
SHA512

c78de35a5bf78dfcc620d8b5f8c96895faade0701c73d38da904c7ab19a24d4a5fd9ced12cacc3889b3c44128d10df106bd6d78d77aa7fa139263e90374d64e5

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/memory/704-133-0x00000000754E0000-0x00000000754E8000-memory.dmp	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/704-133-0x00000000754E0000-0x00000000754E8000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 704	4340	rundll32.exe	80
PID 4340 wrote to memory of 704	4340	rundll32.exe	80
PID 4340 wrote to memory of 704	4340	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e8f64fe165abbb104d725b5f00b6fcafbc584df3f55c7468814b08bf68eb8941.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e8f64fe165abbb104d725b5f00b6fcafbc584df3f55c7468814b08bf68eb8941.dll,#1
  2⤵
  PID:704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/704-132-0x0000000000000000-mapping.dmp

Download
memory/704-133-0x00000000754E0000-0x00000000754E8000-memory.dmp

Filesize
32KB

Download