2e6d0446bcc9a86bf0bdfe91fac3160f48f2eff5ab595eb36db172eea072d6c4 | Triage

Analysis

max time kernel
126s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
04-02-2024 04:04

Sharing

Report Analysis Logs

General

Target

8e2c6a08fa7ed8e9ff93217d16f3cb42.dll
Size

65KB
MD5

8e2c6a08fa7ed8e9ff93217d16f3cb42
SHA1

8eca73f9eef5b6e5b1a8644b982b6bfee7dfc9ed
SHA256

2e6d0446bcc9a86bf0bdfe91fac3160f48f2eff5ab595eb36db172eea072d6c4
SHA512

d96b028bb31bef4e2fa35f1ff27e727a00d4e29cf05c9c9cdf65e856c72990cddcd454a6a19cd2ac5cb4e3d4ac53421deeb26a57b8416ae0712e45e43d0c81c3
SSDEEP

1536:yjJMzqRhEZLaWTfy5RXZR3fqP9JjA9U45UlVp:ObEJaWzy5RXZy9a9U5lVp

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3940-0-0x0000000010000000-0x0000000010663000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 3940	3688	rundll32.exe	20
PID 3688 wrote to memory of 3940	3688	rundll32.exe	20
PID 3688 wrote to memory of 3940	3688	rundll32.exe	20

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8e2c6a08fa7ed8e9ff93217d16f3cb42.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8e2c6a08fa7ed8e9ff93217d16f3cb42.dll,#1
  2⤵
  PID:3940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3940-0-0x0000000010000000-0x0000000010663000-memory.dmp

Filesize
6.4MB

Download
memory/3940-1-0x0000000010000000-0x0000000010663000-memory.dmp

Filesize
6.4MB

Download