230f0082865e50035b6852690a86d1c58cdf8f04849bcd108b5f47bfd1fd4f0b | Triage

Resubmissions

22/02/2024, 02:16

240222-cp8shaah72 7

22/02/2024, 02:13

240222-cnpm8sah54 7

Analysis

max time kernel
144s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2024, 02:13

Sharing

Report Analysis Logs

General

Target

infomgr.dll
Size

224KB
MD5

48b3adf1cc74f5f53951c4f42be136cc
SHA1

2eb25f2d8fe6c3267d3611b399358ee56de88d4c
SHA256

4b1abdad6b106c0f11b260961532ff5847239943ac2c9c8bfdfdd4c80636bcd7
SHA512

25b8d951fb685b1b56305f55f891ef90e44bd6e9828b2675a530523faa78cabe421ba506ea241790cfe643d7258909da51e4bae3f363bfc6de201311d56490d5
SSDEEP

6144:5biZ72xYXoHPOgK9tnuoQZgEUrTJvecqM:g72woWgKgoLEUrTtJ

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3012-0-0x0000000010000000-0x00000000100E9000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 3012	4564	rundll32.exe	86
PID 4564 wrote to memory of 3012	4564	rundll32.exe	86
PID 4564 wrote to memory of 3012	4564	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\infomgr.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\infomgr.dll,#1
  2⤵
  PID:3012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3012-0-0x0000000010000000-0x00000000100E9000-memory.dmp

Filesize
932KB

Download