5bf39101edeab0d2e8df20961de3ca677814fcf234e250018b4a5471fdb47c85 | Triage

Analysis

max time kernel
144s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28-12-2023 21:19

Sharing

Report Analysis Logs

General

Target

f8d7dc737a278e8fded29e305e6b8224.dll
Size

68KB
MD5

f8d7dc737a278e8fded29e305e6b8224
SHA1

b07681ba9568d88c43f062b8b549e8397cf7e974
SHA256

5bf39101edeab0d2e8df20961de3ca677814fcf234e250018b4a5471fdb47c85
SHA512

cdd2056468e327350abe76cda29dc6cbff986b207e2e7e404a5c2348423c46a3bba88f226d73deeddc0a61d612f50098b886f64a8e8771ce9a2d7241aa414bbc
SSDEEP

1536:Bm1NGJVGj0oB6E1AFDKyx27+w4jlm2sCriVVNU4Ms:kX0VCfmFDKysYjMHCrGos

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/5100-0-0x0000000010000000-0x0000000010013000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 5100	2480	rundll32.exe	87
PID 2480 wrote to memory of 5100	2480	rundll32.exe	87
PID 2480 wrote to memory of 5100	2480	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8d7dc737a278e8fded29e305e6b8224.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8d7dc737a278e8fded29e305e6b8224.dll,#1
  2⤵
  PID:5100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5100-0-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download