884a371cf2c2ba12b64ea19d8881efb506ec5a1b5473fe8500114a6b0705d495 | Triage

Analysis

max time kernel
200s
max time network
213s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 22:46

Sharing

Report Analysis Logs

General

Target

884a371cf2c2ba12b64ea19d8881efb506ec5a1b5473fe8500114a6b0705d495.dll
Size

3KB
MD5

ab7098ede68ad98d927080cd3d544720
SHA1

aa4fd8ed23b989695579b8a40d5220e81f3d9201
SHA256

884a371cf2c2ba12b64ea19d8881efb506ec5a1b5473fe8500114a6b0705d495
SHA512

6e264526c7033ea44ef8bb883a199fbd9fd55a1df0340dc4415f6e94513c751faaf8a9133a81f1f965bf0ba8a423a6394b58fa1fbad0160393cd0aef89325df7

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/memory/2912-133-0x00000000750D0000-0x00000000750D8000-memory.dmp	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2912-133-0x00000000750D0000-0x00000000750D8000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 2912	3940	rundll32.exe	82
PID 3940 wrote to memory of 2912	3940	rundll32.exe	82
PID 3940 wrote to memory of 2912	3940	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\884a371cf2c2ba12b64ea19d8881efb506ec5a1b5473fe8500114a6b0705d495.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\884a371cf2c2ba12b64ea19d8881efb506ec5a1b5473fe8500114a6b0705d495.dll,#1
  2⤵
  PID:2912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2912-133-0x00000000750D0000-0x00000000750D8000-memory.dmp

Filesize
32KB

Download