bf73b16bf3e9f93bf8eb0719bba7b7c477ac2eb4745761b0ca7851cf64089620 | Triage

Analysis

max time kernel
114s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2024, 21:23

Sharing

Report Analysis Logs

General

Target

47352d1d912babd62c5ce2e3c6f74e11.dll
Size

66KB
MD5

47352d1d912babd62c5ce2e3c6f74e11
SHA1

800c76f7e802f83f4dd575fb6495f6e96a803ec8
SHA256

bf73b16bf3e9f93bf8eb0719bba7b7c477ac2eb4745761b0ca7851cf64089620
SHA512

b572168692b3ff2a65ad1bb3ef625adeafe67c0b3095bcadd700dadfd9002234e4755d1abc97eb0bc99495959075cac5b8bc092db5a5aaad25803b1702e0bc4b
SSDEEP

1536:9e3LyU2KxB+KUms0ajwkv8tj1r06liYKD:YbyF2k7jYVV06li7

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4256-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 4256	3700	rundll32.exe	12
PID 3700 wrote to memory of 4256	3700	rundll32.exe	12
PID 3700 wrote to memory of 4256	3700	rundll32.exe	12

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\47352d1d912babd62c5ce2e3c6f74e11.dll,#1
1⤵
PID:4256

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\47352d1d912babd62c5ce2e3c6f74e11.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4256-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download