4be77c019328203bc16fcd6ab62b41e26e14edfdc4572448d0ddb101ba796ec9 | Triage

Analysis

max time kernel
93s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2024, 02:42

Sharing

Report Analysis Logs

General

Target

_ssl.dll
Size

525KB
MD5

1c7a6a86a0de4aa88eb96d6ff9c3732f
SHA1

64edaec54086dc1cabdaaa882a9048de9eff680c
SHA256

4a2a6b02c3903356f1e57b4ed07a2a0e601eab7bef735be21bd9620bf681e1ec
SHA512

44d96c0fd3762343aa6e49aa973561f5cd3c075c338019d2a97655e7aecbf4b82beb90eb45737fedfa901f3d54168e056f1cb21520912fd89619b00a788a995a
SSDEEP

12288:ANRpX6OlDkhtd+wVgnSu+jcM0psTVMaPKEWPVPTMSb:ANRdpkhtIShJVVTyJNPt

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral32/memory/3820-0-0x0000000075440000-0x0000000075593000-memory.dmp	upx
behavioral32/memory/3820-1-0x00000000750B0000-0x0000000075372000-memory.dmp	upx
behavioral32/memory/3820-2-0x0000000075440000-0x0000000075593000-memory.dmp	upx
behavioral32/memory/3820-3-0x00000000750B0000-0x0000000075372000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3748	3820	WerFault.exe	48

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 3820	412	rundll32.exe	48
PID 412 wrote to memory of 3820	412	rundll32.exe	48
PID 412 wrote to memory of 3820	412	rundll32.exe	48

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\_ssl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\_ssl.dll,#1
  2⤵
  PID:3820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3820 -s 632
    3⤵
    - Program crash
    PID:3748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3820 -ip 3820
1⤵
PID:3940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3820-0-0x0000000075440000-0x0000000075593000-memory.dmp

Filesize
1.3MB

Download
memory/3820-1-0x00000000750B0000-0x0000000075372000-memory.dmp

Filesize
2.8MB

Download
memory/3820-2-0x0000000075440000-0x0000000075593000-memory.dmp

Filesize
1.3MB

Download
memory/3820-3-0x00000000750B0000-0x0000000075372000-memory.dmp

Filesize
2.8MB

Download