30a32baba290c0515d3c98b33880e78c56a0ffd018013dcba1b92bea2d7e7921 | Triage

Analysis

max time kernel
141s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03-02-2024 18:49

Sharing

Report Analysis Logs

General

Target

8d15413f5735e60f713fde948344c453.dll
Size

201KB
MD5

8d15413f5735e60f713fde948344c453
SHA1

e5f5d0e68dba35b28856336333be1ef20c5d98be
SHA256

30a32baba290c0515d3c98b33880e78c56a0ffd018013dcba1b92bea2d7e7921
SHA512

2e27ce060e2cadcab22355e3b83456dcb03b567c168addb8ecbf5008dadddb9482810156bc12fe36c168666670777280b55316f77f8012a153214e7c7d21327a
SSDEEP

6144:hj+HytMv9Ki7fItnMjnLJJyuysnRo9sApoS:p9evIirMnM80C1poS

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4852-0-0x0000000000AA0000-0x0000000000B0A000-memory.dmp	upx
behavioral2/memory/4852-1-0x0000000000AA0000-0x0000000000B0A000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
560	4852	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3348 wrote to memory of 4852	3348	rundll32.exe	84
PID 3348 wrote to memory of 4852	3348	rundll32.exe	84
PID 3348 wrote to memory of 4852	3348	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8d15413f5735e60f713fde948344c453.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8d15413f5735e60f713fde948344c453.dll,#1
  2⤵
  PID:4852
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 560
    3⤵
    - Program crash
    PID:560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4852 -ip 4852
1⤵
PID:3924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4852-0-0x0000000000AA0000-0x0000000000B0A000-memory.dmp

Filesize
424KB

Download
memory/4852-1-0x0000000000AA0000-0x0000000000B0A000-memory.dmp

Filesize
424KB

Download
memory/4852-2-0x0000000000740000-0x0000000000754000-memory.dmp

Filesize
80KB

Download
memory/4852-3-0x0000000000AA0000-0x0000000000B0A000-memory.dmp

Filesize
424KB

Download