47a6fc5ee1c76053c024f1934df53afa05213bae6c170f3a1042923ec42b3df3 | Triage

Analysis

max time kernel
164s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 21:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3d59e3af743e8341acc04e738b248e33.dll
Size

70KB
MD5

3d59e3af743e8341acc04e738b248e33
SHA1

56816e562a737b6fe77e5b9bc70842da7cac723c
SHA256

47a6fc5ee1c76053c024f1934df53afa05213bae6c170f3a1042923ec42b3df3
SHA512

8ab3e65a768b73ab9ce79ceb0a581639cff9fd452f11fff1824d5a7d8e6933ea7d1c70e8dc01eaa0dd7d2e9fa1d0b2c3e18b2d471a514967f78e2dced31dcc63
SSDEEP

1536:IykzkagsBnYHj2AX78AqpGD8mXlTUqfXbzC:IFzkazBnMjJXQAqAnlgIbzC

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4540-0-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 4540	1972	rundll32.exe	88
PID 1972 wrote to memory of 4540	1972	rundll32.exe	88
PID 1972 wrote to memory of 4540	1972	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d59e3af743e8341acc04e738b248e33.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d59e3af743e8341acc04e738b248e33.dll,#1
  2⤵
  PID:4540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4540-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download