b8980c20b6e3514c70b112d8c4c9bc23e197ba877fff9cb5939c7399dc66dd85 | Triage

Analysis

max time kernel
133s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05/01/2024, 10:44

Sharing

Report Analysis Logs

General

Target

437ad2d99d3dfb452dcdfc72f7f4b61f.dll
Size

59KB
MD5

437ad2d99d3dfb452dcdfc72f7f4b61f
SHA1

e67f5723a9d9f55d663fe64f41f8642392065bd4
SHA256

b8980c20b6e3514c70b112d8c4c9bc23e197ba877fff9cb5939c7399dc66dd85
SHA512

7fc4a88f6af21bbb576c6381d690a1eaebbda49704f2fe02685e2e25d565ccf5adb9a9317306c7571a409fee0e202d6d1b65850cd36e30134f2c911e87b8a4d4
SSDEEP

1536:GQ3tfgXKoKGf4UGHcSHqBYn4aQc4CQpueGi+n4pz8:VfgXK4zKcSKyCCuuGQ

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4356-0-0x0000000010000000-0x0000000010016000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 4356	4448	rundll32.exe	88
PID 4448 wrote to memory of 4356	4448	rundll32.exe	88
PID 4448 wrote to memory of 4356	4448	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\437ad2d99d3dfb452dcdfc72f7f4b61f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\437ad2d99d3dfb452dcdfc72f7f4b61f.dll,#1
  2⤵
  PID:4356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4356-0-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download