884a371cf2c2ba12b64ea19d8881efb506ec5a1b5473fe8500114a6b0705d495 | Triage

Analysis

max time kernel
43s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 22:46

Sharing

Report Analysis Logs

General

Target

884a371cf2c2ba12b64ea19d8881efb506ec5a1b5473fe8500114a6b0705d495.dll
Size

3KB
MD5

ab7098ede68ad98d927080cd3d544720
SHA1

aa4fd8ed23b989695579b8a40d5220e81f3d9201
SHA256

884a371cf2c2ba12b64ea19d8881efb506ec5a1b5473fe8500114a6b0705d495
SHA512

6e264526c7033ea44ef8bb883a199fbd9fd55a1df0340dc4415f6e94513c751faaf8a9133a81f1f965bf0ba8a423a6394b58fa1fbad0160393cd0aef89325df7

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/memory/820-57-0x00000000747A0000-0x00000000747A8000-memory.dmp	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/820-57-0x00000000747A0000-0x00000000747A8000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 820	1096	rundll32.exe	28
PID 1096 wrote to memory of 820	1096	rundll32.exe	28
PID 1096 wrote to memory of 820	1096	rundll32.exe	28
PID 1096 wrote to memory of 820	1096	rundll32.exe	28
PID 1096 wrote to memory of 820	1096	rundll32.exe	28
PID 1096 wrote to memory of 820	1096	rundll32.exe	28
PID 1096 wrote to memory of 820	1096	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\884a371cf2c2ba12b64ea19d8881efb506ec5a1b5473fe8500114a6b0705d495.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\884a371cf2c2ba12b64ea19d8881efb506ec5a1b5473fe8500114a6b0705d495.dll,#1
  2⤵
  PID:820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/820-55-0x0000000075991000-0x0000000075993000-memory.dmp

Filesize
8KB

Download
memory/820-56-0x00000000747B0000-0x00000000747B8000-memory.dmp

Filesize
32KB

Download
memory/820-57-0x00000000747A0000-0x00000000747A8000-memory.dmp

Filesize
32KB

Download
memory/820-58-0x00000000747B0000-0x00000000747B8000-memory.dmp

Filesize
32KB

Download