e1d143958486dd57b59894eebdb67a238a0daff7290ead692761fef897ddd392 | Triage

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 03:51

Sharing

Report Analysis Logs

General

Target

03eb8a68f6e5f2fca41f1ca35b620d6e.dll
Size

416KB
MD5

03eb8a68f6e5f2fca41f1ca35b620d6e
SHA1

e787c020a30a0742cf065aa30ed7526104142e7f
SHA256

e1d143958486dd57b59894eebdb67a238a0daff7290ead692761fef897ddd392
SHA512

1589f94df31403bae13acf7da52c20f0452b860614b437f5785077a17d87a2a120268812dbe103059b3c68380c4b930d770d84ffebde71f07dea2cb323eeee38
SSDEEP

12288:ANTzjygbjyHwj/A7ifqi17W0CSU1kwA2+:ANr2Hh7irVgW/

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1232-0-0x0000000010000000-0x0000000010129000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 1232	5024	rundll32.exe	25
PID 5024 wrote to memory of 1232	5024	rundll32.exe	25
PID 5024 wrote to memory of 1232	5024	rundll32.exe	25

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\03eb8a68f6e5f2fca41f1ca35b620d6e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\03eb8a68f6e5f2fca41f1ca35b620d6e.dll,#1
  2⤵
  PID:1232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1232-0-0x0000000010000000-0x0000000010129000-memory.dmp

Filesize
1.2MB

Download