251d7f44ded406ce3b8a468185032ffc580a05ecf315fd00535c1b0b0eefe450 | Triage

Analysis

max time kernel
140s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 01:15

Sharing

Report Analysis Logs

General

Target

09c45670675b99882c9946d109df977b.dll
Size

13KB
MD5

09c45670675b99882c9946d109df977b
SHA1

beb371392b3ab03474a9eef957983e686c088d81
SHA256

251d7f44ded406ce3b8a468185032ffc580a05ecf315fd00535c1b0b0eefe450
SHA512

3d4a85eaca213f1c07b142863c9128724939461f65e5cfaeb3aaceabd321238b0353dfde3c479fe51031608e8ab75ca7a6bf6a0010d63bad9bf00eb897e2806b
SSDEEP

384:UEARz/NoQJ4rVht9tjOXVVsdmQuayHQL0:q/NJKht9tVdgQ4

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3800-0-0x0000000010000000-0x000000001000C000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3800	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 3800	2348	rundll32.exe	14
PID 2348 wrote to memory of 3800	2348	rundll32.exe	14
PID 2348 wrote to memory of 3800	2348	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09c45670675b99882c9946d109df977b.dll,#1
1⤵
- Suspicious use of SetWindowsHookEx
PID:3800

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09c45670675b99882c9946d109df977b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3800-0-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download