8b8c952b4899f958e2cfb8743221acbe90e033fc89acb424533495e0da037112 | Triage

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 04:41

Sharing

Report Analysis Logs

General

Target

28970900cd559a2ae9b25597c2325ede.dll
Size

7KB
MD5

28970900cd559a2ae9b25597c2325ede
SHA1

0cdb52fbd336ee6c60e3086a2ef08f6f03fd6f1f
SHA256

8b8c952b4899f958e2cfb8743221acbe90e033fc89acb424533495e0da037112
SHA512

3e4e020a80ba77f29be4b0177606ec096e975c32faea4e212b619a196c5b550ef0d8b733e0d5ed7369446fa15a555b9b1ab4777c6dd96ddaccae828e564297be
SSDEEP

192:GnfAgv9rC9S0hHPaPHiEK0YBLhTrRsqxtW:GIG8SUr0YBLhBBtW

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2840-0-0x0000000010000000-0x0000000010009000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2840	rundll32.exe
2840	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 2840	4488	rundll32.exe	16
PID 4488 wrote to memory of 2840	4488	rundll32.exe	16
PID 4488 wrote to memory of 2840	4488	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\28970900cd559a2ae9b25597c2325ede.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2840

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\28970900cd559a2ae9b25597c2325ede.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2840-0-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download