2335bc20f9515a2f2d152face2e7d86a9dc271d1cf995199625e4e776103dcf1 | Triage

Analysis

max time kernel
91s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2024 04:39

Sharing

Report Analysis Logs

General

Target

8894131a24716266a826c3193fbc5ec7.dll
Size

67KB
MD5

8894131a24716266a826c3193fbc5ec7
SHA1

9ecce16f5db833272433f9d5a1b638846be02c4f
SHA256

2335bc20f9515a2f2d152face2e7d86a9dc271d1cf995199625e4e776103dcf1
SHA512

189d9de6cd5ed07414371c303adde4b381b1365e11e41947e287301e4f84eda874c8dfb9b0bff9f4f7c83c5b85d4e652bbada86edd1006ba495716176680eef4
SSDEEP

1536:ob8Vwn/9zRGVOWK/k2A3WtMZ7fxb4IK6ir3kOQK:oz/3iCFMZKCEU0

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4716-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 460 wrote to memory of 4716	460	rundll32.exe	20
PID 460 wrote to memory of 4716	460	rundll32.exe	20
PID 460 wrote to memory of 4716	460	rundll32.exe	20

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8894131a24716266a826c3193fbc5ec7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8894131a24716266a826c3193fbc5ec7.dll,#1
  2⤵
  PID:4716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4716-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download