db0d0c3dc48d3d619b4ee7cdc63ef2726c7781c8d9981e836cfbac45b3d27bb7 | Triage

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 10:58

Sharing

Report Analysis Logs

General

Target

48c8d3cf51777df66b48b5daf42896e7.dll
Size

202KB
MD5

48c8d3cf51777df66b48b5daf42896e7
SHA1

4bb1be0a60e738225bb9f024ca01bb51031b0ed1
SHA256

db0d0c3dc48d3d619b4ee7cdc63ef2726c7781c8d9981e836cfbac45b3d27bb7
SHA512

a82cbd148d94f14420bcefe8744b86b8fe8b3081e5133bd272f17aa9e914f74423e7fcb060470c183ecefa835427061d62c096b56243a487a7593dec459738d4
SSDEEP

6144:vE/tmQKul1p9sjeRcsBPcu5y9xaJr3tnmdZy4Z:vE/tmtuZLpJcusxKwdfZ

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3508-0-0x0000000000400000-0x000000000044D000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4044	3508	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3228 wrote to memory of 3508	3228	rundll32.exe	14
PID 3228 wrote to memory of 3508	3228	rundll32.exe	14
PID 3228 wrote to memory of 3508	3228	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\48c8d3cf51777df66b48b5daf42896e7.dll,#1
1⤵
PID:3508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3508 -s 568
  2⤵
  - Program crash
  PID:4044

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\48c8d3cf51777df66b48b5daf42896e7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3508 -ip 3508
1⤵
PID:4856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3508-1-0x0000000000EF0000-0x0000000000F05000-memory.dmp

Filesize
84KB

Download
memory/3508-0-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download