6ca921b4e27b02ceeee3b7f6e8f59aca8cba52b0f5d458913a03365b8da6c6c6 | Triage

Analysis

max time kernel
123s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 23:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6ca921b4e27b02ceeee3b7f6e8f59aca8cba52b0f5d458913a03365b8da6c6c6.dll
Size

3KB
MD5

78f1885ff64286b06d1841c8cb691d90
SHA1

b340c72e4ebe1eac8a2c8f2b3a69e53369e58fe3
SHA256

6ca921b4e27b02ceeee3b7f6e8f59aca8cba52b0f5d458913a03365b8da6c6c6
SHA512

9a7cafb85f78829e6c1721c6824187f4d9b5687d33dcdb931e0dc8a3fe12561b9680313831bba955f913b7828915a44a1274af1d2267f7924d05e9a1a71703a8

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/memory/4760-133-0x00000000750A0000-0x00000000750A8000-memory.dmp	acprotect
behavioral2/memory/4760-134-0x00000000750A0000-0x00000000750A8000-memory.dmp	acprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4760-133-0x00000000750A0000-0x00000000750A8000-memory.dmp	upx
behavioral2/memory/4760-134-0x00000000750A0000-0x00000000750A8000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 4760	2516	rundll32.exe	82
PID 2516 wrote to memory of 4760	2516	rundll32.exe	82
PID 2516 wrote to memory of 4760	2516	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ca921b4e27b02ceeee3b7f6e8f59aca8cba52b0f5d458913a03365b8da6c6c6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ca921b4e27b02ceeee3b7f6e8f59aca8cba52b0f5d458913a03365b8da6c6c6.dll,#1
  2⤵
  PID:4760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4760-133-0x00000000750A0000-0x00000000750A8000-memory.dmp

Filesize
32KB

Download
memory/4760-134-0x00000000750A0000-0x00000000750A8000-memory.dmp

Filesize
32KB

Download