e75b2e3023d9df8e2b4862f040b280dfd18997a11b9b0fc4cb28bc7dafafaa83 | Triage

Analysis

max time kernel
147s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10-01-2024 03:31

Sharing

Report Analysis Logs

General

Target

gensmnq/gensmnq_ttrar/kailleraclient.dll
Size

31KB
MD5

c3f8a9c4cfd257f22ba3a0f2d9e23ff0
SHA1

ad9be4eb84f31b23a6f1ba7cc490940bdde29d64
SHA256

35a8f5f6b858e6af5dc34eec2bbe397ea230c09eaffbb976c42f4b096cfc2551
SHA512

31f77be2487ac691f09bd5e3463c2ed6b00f1f75b3ac6b38becb9377dacb00b3c1aae2de70961212af04e6b0e6f26ab716dead2fb7d87b9c7639ed0e2d27dd99
SSDEEP

768:2viLjbKGY60H17PJc/TG0BXOZDRm55lEv1Lk1:oK/Oh17PeqAgDRmjym1

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral4/memory/1044-0-0x0000000010000000-0x0000000010017000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 1044	4340	rundll32.exe	16
PID 4340 wrote to memory of 1044	4340	rundll32.exe	16
PID 4340 wrote to memory of 1044	4340	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gensmnq\gensmnq_ttrar\kailleraclient.dll,#1
1⤵
PID:1044

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gensmnq\gensmnq_ttrar\kailleraclient.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1044-0-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download