9c3fbde46a640e9f56735158318fbf956df842c6334b6f4906ae6a24dc4c766b | Triage

Analysis

max time kernel
124s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 22:38

Sharing

Report Analysis Logs

General

Target

9c3fbde46a640e9f56735158318fbf956df842c6334b6f4906ae6a24dc4c766b.dll
Size

3KB
MD5

42435a3c4eb5335f530c18e973cda1d0
SHA1

6e553a1e6e65ee96c3d9e5e0b6c7b9911763655d
SHA256

9c3fbde46a640e9f56735158318fbf956df842c6334b6f4906ae6a24dc4c766b
SHA512

024649f8059b3a3d72772d3337155a70f70127fb50f2e34191b8a6b144035b4c776b191e265c541bae270322a7bcd6a23bc31fa7e22405e180672c478d6df244

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/memory/4972-133-0x00000000754C0000-0x00000000754C8000-memory.dmp	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4972-133-0x00000000754C0000-0x00000000754C8000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 4972	5056	rundll32.exe	82
PID 5056 wrote to memory of 4972	5056	rundll32.exe	82
PID 5056 wrote to memory of 4972	5056	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9c3fbde46a640e9f56735158318fbf956df842c6334b6f4906ae6a24dc4c766b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9c3fbde46a640e9f56735158318fbf956df842c6334b6f4906ae6a24dc4c766b.dll,#1
  2⤵
  PID:4972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4972-133-0x00000000754C0000-0x00000000754C8000-memory.dmp

Filesize
32KB

Download