fb45659fdd5650d96f97f99684a5b2823868dd404b8d8258101e5c3ae2322d4d | Triage

Analysis

max time kernel
92s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
22/01/2024, 14:18

Sharing

Report Analysis Logs

General

Target

6fa42a2c728953c926050ffcf17436b6.dll
Size

59KB
MD5

6fa42a2c728953c926050ffcf17436b6
SHA1

16ad57a7ef5b07afafa6ea1700a34f6e5611f19f
SHA256

fb45659fdd5650d96f97f99684a5b2823868dd404b8d8258101e5c3ae2322d4d
SHA512

8cb1a082758670829c4e3dc047c8ed51f0022f360ede81d576267238c3820c8c3fb21a2cfec4e7ede14750f7e32bc4911bbcb68ca2590f5fc5a66a62432c56f6
SSDEEP

1536:yl3E0Toa41QshFGbqCiR8SlRksVYHYC8u:E39D4GboFl5mHz

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/368-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 368	4344	rundll32.exe	86
PID 4344 wrote to memory of 368	4344	rundll32.exe	86
PID 4344 wrote to memory of 368	4344	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6fa42a2c728953c926050ffcf17436b6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6fa42a2c728953c926050ffcf17436b6.dll,#1
  2⤵
  PID:368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/368-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download