bb0cd139a2decc06493474fe8adaf03998dce9bcaf633c0e804d9b58d07829f5 | Triage

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2023 18:51

Sharing

Report Analysis Logs

General

Target

00f6ae56abf6a00a17e89ad6a0fea8ae.dll
Size

62KB
MD5

00f6ae56abf6a00a17e89ad6a0fea8ae
SHA1

8a2db6cbdb828d803ad4d3bdaf8e1abebc0761f6
SHA256

bb0cd139a2decc06493474fe8adaf03998dce9bcaf633c0e804d9b58d07829f5
SHA512

da5dd900ddc46eb8f60ed9f1586f89da2d036c791b67367aa66b41ee031bee06df1bf91372ef04337464b460e92f0c44e7b941146c957f580e064a6b150dd677
SSDEEP

1536:RS0JhrmPnAqbxAGxHFD/UWeSx+eK1kpPek8D:RS4hCPnVC4HFU1klK

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3040-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 3040	4452	rundll32.exe	89
PID 4452 wrote to memory of 3040	4452	rundll32.exe	89
PID 4452 wrote to memory of 3040	4452	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00f6ae56abf6a00a17e89ad6a0fea8ae.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\00f6ae56abf6a00a17e89ad6a0fea8ae.dll,#1
  2⤵
  PID:3040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3040-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download