cf10e71baa79137f9d1b412b6597abc14d8cac1f21e9094c6df57ce8c988fe46 | Triage

Analysis

max time kernel
142s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 20:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cf10e71baa79137f9d1b412b6597abc14d8cac1f21e9094c6df57ce8c988fe46.dll
Size

3KB
MD5

922cddb6e087378e6621eda191b09140
SHA1

ee48b7951c44b34b493616ca64f291862ea3da7d
SHA256

cf10e71baa79137f9d1b412b6597abc14d8cac1f21e9094c6df57ce8c988fe46
SHA512

78abe0b3e98992bddd7816be2639afe2638bc20816ad7171e168ab7d8716306874c8870639213f22125b51740113d5c6118f2b80eadc5bee1fe9d3378a518620

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/memory/2112-133-0x0000000075680000-0x0000000075688000-memory.dmp	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2112-133-0x0000000075680000-0x0000000075688000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 2112	3352	rundll32.exe	44
PID 3352 wrote to memory of 2112	3352	rundll32.exe	44
PID 3352 wrote to memory of 2112	3352	rundll32.exe	44

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf10e71baa79137f9d1b412b6597abc14d8cac1f21e9094c6df57ce8c988fe46.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf10e71baa79137f9d1b412b6597abc14d8cac1f21e9094c6df57ce8c988fe46.dll,#1
  2⤵
  PID:2112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2112-133-0x0000000075680000-0x0000000075688000-memory.dmp

Filesize
32KB

Download