c1370db3e617fa668c646c4cbe76e5f4788df087043de0c31b4b379dd317c90c | Triage

Analysis

max time kernel
101s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 01:05

Sharing

Report Analysis Logs

General

Target

c1370db3e617fa668c646c4cbe76e5f4788df087043de0c31b4b379dd317c90c.dll
Size

3KB
MD5

a47efb2907348015f77d6e2b80a5ad30
SHA1

3eb8aa8bc4a54981be8ec5112a92bca9cb316ac7
SHA256

c1370db3e617fa668c646c4cbe76e5f4788df087043de0c31b4b379dd317c90c
SHA512

2083af7487e49a6081349862be736a67e3344d176ddcb75ec13e70ae0fa9ad0ed1849790d2f25f5aa6e75d1bde187a0abb88350fb6962fab88f54a7a92d675fe

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/memory/4540-136-0x0000000075460000-0x0000000075468000-memory.dmp	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4540-136-0x0000000075460000-0x0000000075468000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 4540	4964	rundll32.exe	68
PID 4964 wrote to memory of 4540	4964	rundll32.exe	68
PID 4964 wrote to memory of 4540	4964	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1370db3e617fa668c646c4cbe76e5f4788df087043de0c31b4b379dd317c90c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1370db3e617fa668c646c4cbe76e5f4788df087043de0c31b4b379dd317c90c.dll,#1
  2⤵
  PID:4540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4540-136-0x0000000075460000-0x0000000075468000-memory.dmp

Filesize
32KB

Download