a07062cb5e0bc9f8f7250ba9f1b1e81641c96b74659af89da2da28b983a8cef4 | Triage

Analysis

max time kernel
91s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 20:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

XMTS20090628/程序功能/CHJ002.dll
Size

220KB
MD5

9fdec337d2dc55751f38d817abf6c3c9
SHA1

57501f467a66e425893af479325af6de9c851578
SHA256

2903067697dcfd6b63bbba7c81b21741770e73a61e858829cc282ee576722a26
SHA512

e77d808b6787c83c7eef0057c619a1001969be307055cc67368377bc2219009054bbc1d769870ba635948f2626d0ef7a6a486dd06e57afab25fcf5cd60b36e33
SSDEEP

6144:fSJbfY8DSPkoJmz86nxGEcvscF6TnEgur4U:fSJbJDScWmz868Ecvs//U

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral12/memory/4304-1-0x00000000026E0000-0x0000000002771000-memory.dmp	upx
behavioral12/memory/4304-0-0x00000000026E0000-0x0000000002771000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 4304	4256	rundll32.exe	21
PID 4256 wrote to memory of 4304	4256	rundll32.exe	21
PID 4256 wrote to memory of 4304	4256	rundll32.exe	21

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XMTS20090628\程序功能\CHJ002.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\XMTS20090628\程序功能\CHJ002.dll,#1
  2⤵
  PID:4304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4304-1-0x00000000026E0000-0x0000000002771000-memory.dmp

Filesize
580KB

Download
memory/4304-0-0x00000000026E0000-0x0000000002771000-memory.dmp

Filesize
580KB

Download