b5eca7746b9db70a5b2fe514e0336ef52123493726ce4af5ad4e7eddbffca44b | Triage

Analysis

max time kernel
147s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 23:07

Sharing

Report Analysis Logs

General

Target

1f714542f94e8e5bd2272beb6331364a.dll
Size

60KB
MD5

1f714542f94e8e5bd2272beb6331364a
SHA1

0819b29809b04be8eb87fc0612a5e26bc57e8ba0
SHA256

b5eca7746b9db70a5b2fe514e0336ef52123493726ce4af5ad4e7eddbffca44b
SHA512

f35e5584cc7e0e35466083d03630caf544f1399dabd9898f28e9eeb6f0e474b3c726fe5571316f3120c155d5742eba24bdbe12f55b29a17032d38711f3dd5ad9
SSDEEP

1536:EGSphFMMWCgRGvg7a4zilLZPS5ynYFizc4Hqq:EG2+ggwvN4ulPYCWmc4HJ

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1736-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3856 wrote to memory of 1736	3856	rundll32.exe	89
PID 3856 wrote to memory of 1736	3856	rundll32.exe	89
PID 3856 wrote to memory of 1736	3856	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f714542f94e8e5bd2272beb6331364a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f714542f94e8e5bd2272beb6331364a.dll,#1
  2⤵
  PID:1736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1736-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download