88da80af3cb1b030e5264bb64fb6e8e33fbd952c88be17ce3c3d064bc641e287 | Triage

Analysis

max time kernel
90s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
15-02-2024 01:47

Sharing

Report Analysis Logs

General

Target

9ca13dadaf32bca689ec86dd5c69bc5c.dll
Size

216KB
MD5

9ca13dadaf32bca689ec86dd5c69bc5c
SHA1

1c6da178f7b9c3ae28a2370fa797385e993775f2
SHA256

88da80af3cb1b030e5264bb64fb6e8e33fbd952c88be17ce3c3d064bc641e287
SHA512

f9856044417e7e1a1389d182d40f2920080cfee4c1c7cce69c2b9d59fbcf0d91f666c2f464576f9fa87326c632562915eee8fd26ff5b2b9816e2619c8fa62aba
SSDEEP

6144:Hj4+5PYFPco1Zq/TSucVWPo4Bpof1mslhx:5YFRZq/TdUWQ4BCmsP

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4704-0-0x0000000000400000-0x0000000000456000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
872	4704	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 4704	4088	rundll32.exe	86
PID 4088 wrote to memory of 4704	4088	rundll32.exe	86
PID 4088 wrote to memory of 4704	4088	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ca13dadaf32bca689ec86dd5c69bc5c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ca13dadaf32bca689ec86dd5c69bc5c.dll,#1
  2⤵
  PID:4704
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 552
    3⤵
    - Program crash
    PID:872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4704 -ip 4704
1⤵
PID:2708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4704-0-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/4704-1-0x0000000001220000-0x0000000001235000-memory.dmp

Filesize
84KB

Download