36c08c7ec468edcd469ecd5829627db169da03edc8d2056282be992333e86b57 | Triage

Analysis

max time kernel
147s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 16:03

Sharing

Report Analysis Logs

General

Target

2b866048e846f67fc983cb5ca4131fca.dll
Size

97KB
MD5

2b866048e846f67fc983cb5ca4131fca
SHA1

65513390ae876b8839ff176b58b4c96760d7c17c
SHA256

36c08c7ec468edcd469ecd5829627db169da03edc8d2056282be992333e86b57
SHA512

e34dffdfb54b9d46ce6c854e8d1f7318c4c08f74189c0980bc070ffeb59a4d2588c70d4ac1f6104667264ac7db4b2876c7a937c58c8e1cd4a0af154db3d5248f
SSDEEP

3072:g7SMAEsp+akL6ma0BRR7LuSFA4fhRzqEs:g7S3B7Q6mDTnTlhcEs

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3828-0-0x0000000010000000-0x000000001002C000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1572	3828	WerFault.exe	16

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 3828	552	rundll32.exe	16
PID 552 wrote to memory of 3828	552	rundll32.exe	16
PID 552 wrote to memory of 3828	552	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b866048e846f67fc983cb5ca4131fca.dll,#1
1⤵
PID:3828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 552
  2⤵
  - Program crash
  PID:1572

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b866048e846f67fc983cb5ca4131fca.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3828 -ip 3828
1⤵
PID:2160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3828-0-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download