99f8bb57e1b66139b5ee077fe77fa9f6358f3a5b5b69eb84cb9a82fb334a492b | Triage

Analysis

max time kernel
90s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 21:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

99f8bb57e1b66139b5ee077fe77fa9f6358f3a5b5b69eb84cb9a82fb334a492b.dll
Size

3KB
MD5

4405574b23d7a80c7f9636478d36e3d0
SHA1

59e238f49783f06948c237f3c67acbb8b26f1616
SHA256

99f8bb57e1b66139b5ee077fe77fa9f6358f3a5b5b69eb84cb9a82fb334a492b
SHA512

da764e4ed34e8a520d98277276135086671dc8e94413c1160a46b1f1f9e965e3c2c7c3e56632adea735c152c82e7ae74714cb85ac6a7b655ba698b4b34d907eb

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/memory/4540-133-0x0000000074B60000-0x0000000074B68000-memory.dmp	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4540-133-0x0000000074B60000-0x0000000074B68000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 4540	548	rundll32.exe	82
PID 548 wrote to memory of 4540	548	rundll32.exe	82
PID 548 wrote to memory of 4540	548	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\99f8bb57e1b66139b5ee077fe77fa9f6358f3a5b5b69eb84cb9a82fb334a492b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\99f8bb57e1b66139b5ee077fe77fa9f6358f3a5b5b69eb84cb9a82fb334a492b.dll,#1
  2⤵
  PID:4540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4540-133-0x0000000074B60000-0x0000000074B68000-memory.dmp

Filesize
32KB

Download