1a2ec310ec65184670344e1f00c9ccd64ed7e8030f3ad8ee7250a039589da9c2 | Triage

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11-01-2024 08:29

Sharing

Report Analysis Logs

General

Target

530850cb621e89af1a084cfa10f7460b.dll
Size

224KB
MD5

530850cb621e89af1a084cfa10f7460b
SHA1

db95980c83669df95ca049be4c09b061004d359a
SHA256

1a2ec310ec65184670344e1f00c9ccd64ed7e8030f3ad8ee7250a039589da9c2
SHA512

c8c31a4756d1bc7af8ab721f194eb85ace02e7753a52e7ed7db516e12ef7d0ebb647ada1142103de446d383e6b1413f339b1a7a7081dce0f856636e49919c87f
SSDEEP

6144:9cDbJf+58p3M55NfLbfhptwnffqXRgRjwxLTsMp:CD02VM55ZzvtwXqX4jw5

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3096-0-0x0000000000400000-0x0000000000455000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
532	3096	WerFault.exe	62

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 3096	1192	rundll32.exe	62
PID 1192 wrote to memory of 3096	1192	rundll32.exe	62
PID 1192 wrote to memory of 3096	1192	rundll32.exe	62

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\530850cb621e89af1a084cfa10f7460b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\530850cb621e89af1a084cfa10f7460b.dll,#1
  2⤵
  PID:3096
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 568
    3⤵
    - Program crash
    PID:532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3096 -ip 3096
1⤵
PID:1256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3096-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3096-1-0x0000000001420000-0x0000000001434000-memory.dmp

Filesize
80KB

Download