3e593c473ea647790c07e6d1ba5b8fee376a9170daaeb530cb234eacf13d70ac | Triage

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/12/2023, 20:51

Sharing

Report Analysis Logs

General

Target

f7509f2aceb2c76bef5ad6bee49bde57.dll
Size

64KB
MD5

f7509f2aceb2c76bef5ad6bee49bde57
SHA1

6541b4680c5e49fe989ed2eccd2542f6657b0e7b
SHA256

3e593c473ea647790c07e6d1ba5b8fee376a9170daaeb530cb234eacf13d70ac
SHA512

2abb0b895966d3478def05ca67492432c6f63d4cbfa95b63067b23e97ebace2961a1bce85b7ac01c0b5fd051cd5a6c9ebde39dde92970e397575186c43564cef
SSDEEP

1536:yl3E0T8ixN1MpgAn64AVd8SWXnoHQ27dgSfOa9Q:E39QixNu9n64SWXsn7maS

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1188-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 1188	2148	rundll32.exe	14
PID 2148 wrote to memory of 1188	2148	rundll32.exe	14
PID 2148 wrote to memory of 1188	2148	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7509f2aceb2c76bef5ad6bee49bde57.dll,#1
1⤵
PID:1188

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7509f2aceb2c76bef5ad6bee49bde57.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1188-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download