4acd027e21969450c8809b921e44161ee27e4c59a3d027e4a098db3ca12c124e | Triage

Analysis

max time kernel
139s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14-02-2024 00:48

Sharing

Report Analysis Logs

General

Target

9a5a419571b2ccc0ca587d926426bd88.dll
Size

68KB
MD5

9a5a419571b2ccc0ca587d926426bd88
SHA1

cb466578bb7679e01838ee66d80e7193207e6061
SHA256

4acd027e21969450c8809b921e44161ee27e4c59a3d027e4a098db3ca12c124e
SHA512

a4c1674a121de2505c571d2ebfb0c7faff821261b9081153ab8a5e585798e99aa3c8344cb2ed4e4e546772cf92aa13a99b77925f2a43960fa0d0db10e489b9a8
SSDEEP

1536:Bm1NGJVGYCGri2IpguUoK0EeNiSNfKXG8IjF88:kX0VBCFpgJ1NeNZf2a88

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4084-0-0x0000000010000000-0x0000000010013000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 4084	2572	rundll32.exe	84
PID 2572 wrote to memory of 4084	2572	rundll32.exe	84
PID 2572 wrote to memory of 4084	2572	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a5a419571b2ccc0ca587d926426bd88.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a5a419571b2ccc0ca587d926426bd88.dll,#1
  2⤵
  PID:4084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4084-0-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download