f9b405d9f420923124c6c2a769655bfff0c3c05230d58757c82a26bd6b267e49 | Triage

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 22:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f9b405d9f420923124c6c2a769655bfff0c3c05230d58757c82a26bd6b267e49.dll
Size

3KB
MD5

6510a15f7f6fa1b755538726bdb3fa00
SHA1

7a55027631f5b054a2020c0596b3ddd59485afb9
SHA256

f9b405d9f420923124c6c2a769655bfff0c3c05230d58757c82a26bd6b267e49
SHA512

e22865ece46e12fa4b191f49a53b6ebd27f12fc162e0a8ca5a9c4d12f4edf84d9eb611f8b3c8edbc11f67d95b5342cbb099eab85722e5e71150523f3f643c42a

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/memory/2348-133-0x0000000075520000-0x0000000075528000-memory.dmp	acprotect
behavioral2/memory/2348-134-0x0000000075520000-0x0000000075528000-memory.dmp	acprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2348-133-0x0000000075520000-0x0000000075528000-memory.dmp	upx
behavioral2/memory/2348-134-0x0000000075520000-0x0000000075528000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2348	2204	rundll32.exe	78
PID 2204 wrote to memory of 2348	2204	rundll32.exe	78
PID 2204 wrote to memory of 2348	2204	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9b405d9f420923124c6c2a769655bfff0c3c05230d58757c82a26bd6b267e49.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9b405d9f420923124c6c2a769655bfff0c3c05230d58757c82a26bd6b267e49.dll,#1
  2⤵
  PID:2348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2348-133-0x0000000075520000-0x0000000075528000-memory.dmp

Filesize
32KB

Download
memory/2348-134-0x0000000075520000-0x0000000075528000-memory.dmp

Filesize
32KB

Download