41fd7774309f42313280883717b4d4505906f32a33dd75fe9f6d46f4f692bcfc | Triage

Analysis

max time kernel
98s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 16:48

Sharing

Report Analysis Logs

General

Target

65885e96c39edb080642ccc543a32009.dll
Size

66KB
MD5

65885e96c39edb080642ccc543a32009
SHA1

d31454816e307b0da6aca98e3cb9b1d9bb39bc35
SHA256

41fd7774309f42313280883717b4d4505906f32a33dd75fe9f6d46f4f692bcfc
SHA512

01adcb1eff505b135fea49551d895820d597dcbc2fe8707739babe24de2394d4bf4983850d519c588920f463ad9491e0da35beca2cb7c4ab2bf54d35ddecd779
SSDEEP

1536:OsuX6JNR+SVazzZ/eQf5DByOcsfi4bBViFIpnmP5:1/bkS8z9VfJOsq4bBVizP5

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4356-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 4356	4084	rundll32.exe	14
PID 4084 wrote to memory of 4356	4084	rundll32.exe	14
PID 4084 wrote to memory of 4356	4084	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\65885e96c39edb080642ccc543a32009.dll,#1
1⤵
PID:4356

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\65885e96c39edb080642ccc543a32009.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4356-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download