50e0b903ed6c52a07d413228c0e9081f410adf2b80e9eea79d809b2a82ef85f7 | Triage

Analysis

max time kernel
142s
max time network
408s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
24/02/2024, 08:38

Sharing

Report Analysis Logs

General

Target

LorexCloud/FaceDetectUI.dll
Size

2.7MB
MD5

fac31eabff083809391d48a24fe7f594
SHA1

b08576f2c6bc64a15561cd8b9e013b04cc667cdd
SHA256

ffbb9a76965111f8d90f6049b53ed1113e5349d10f22f16313810c655b939b66
SHA512

1ec1c12e849282fee0bb534a2546fd79243391ef0447a06564c1e24e677fcb852d8524c0e534f769b9b48da5257073fb90cacdaab25977f202e25d825315601d
SSDEEP

49152:Bupx6LUmro8P3Ws3Bz1gLkBuPSf7b2Exee6tzVhXnUg6:BmRFUT

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe
3040	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\LorexCloud\FaceDetectUI.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3040-1-0x00007FFC4CD50000-0x00007FFC4D013000-memory.dmp

Filesize
2.8MB

Download
memory/3040-0-0x0000000066300000-0x000000006684B000-memory.dmp

Filesize
5.3MB

Download
memory/3040-2-0x00007FFC41630000-0x00007FFC41742000-memory.dmp

Filesize
1.1MB

Download
memory/3040-3-0x00007FFC3FDA0000-0x00007FFC3FEEE000-memory.dmp

Filesize
1.3MB

Download