62fe539550ea2080048b10408d876f21baa671df5317cb5b0752824beed59d96 | Triage

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2024, 19:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4f0a0b36c5aa20b5cb402a2cb428cd90.dll
Size

128KB
MD5

4f0a0b36c5aa20b5cb402a2cb428cd90
SHA1

a0a40ca4b9bbe37e4e5a2904728aa3f0e9ecdc23
SHA256

62fe539550ea2080048b10408d876f21baa671df5317cb5b0752824beed59d96
SHA512

98725010bfdbad632eff916d65b1b46726912c8fcccf467d102dcfa67b25934559805531bb0ece4f24fff69c0daa13d6f052a6030c14571694ae25b72c000c7f
SSDEEP

3072:KTC5XXLJ4z3ixyWNiTb6vMlYcqKBQnlq6fARgW/9U:f5nCivNiTbll8dt+gei

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3716-0-0x0000000000400000-0x0000000000454000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3696 wrote to memory of 3716	3696	rundll32.exe	88
PID 3696 wrote to memory of 3716	3696	rundll32.exe	88
PID 3696 wrote to memory of 3716	3696	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f0a0b36c5aa20b5cb402a2cb428cd90.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f0a0b36c5aa20b5cb402a2cb428cd90.dll,#1
  2⤵
  PID:3716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3716-0-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download