02d8d26f21eff50f6ab2cbde4498478e7b328cf6b6b7e087c33d059dfa7f4b4e | Triage

Analysis

max time kernel
287s
max time network
308s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 05:14

Sharing

Report Analysis Logs

General

Target

02d8d26f21eff50f6ab2cbde4498478e7b328cf6b6b7e087c33d059dfa7f4b4e.dll
Size

3KB
MD5

75e41a60925c900f3f3ab072a2971090
SHA1

834f0b244aac31d4a20eb0833677fabf99cbf65d
SHA256

02d8d26f21eff50f6ab2cbde4498478e7b328cf6b6b7e087c33d059dfa7f4b4e
SHA512

9005bc132cd075340b7bbc29e684c146db755bc817c45ec13b91466f1f48d72dab916cf5f5384dad1ec554be1963924e358a0aa396f56357b6439641208c826e

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/memory/1936-133-0x0000000074BA0000-0x0000000074BA8000-memory.dmp	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1936-133-0x0000000074BA0000-0x0000000074BA8000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 1936	1264	rundll32.exe	83
PID 1264 wrote to memory of 1936	1264	rundll32.exe	83
PID 1264 wrote to memory of 1936	1264	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\02d8d26f21eff50f6ab2cbde4498478e7b328cf6b6b7e087c33d059dfa7f4b4e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\02d8d26f21eff50f6ab2cbde4498478e7b328cf6b6b7e087c33d059dfa7f4b4e.dll,#1
  2⤵
  PID:1936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1936-133-0x0000000074BA0000-0x0000000074BA8000-memory.dmp

Filesize
32KB

Download