c7abdc5c18a0a75619b1b6f931223e019a116bd0489950a328e53411258d3072 | Triage

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 07:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bad4e2e7504f8534458a9d9dd7b1362f.dll
Size

15KB
MD5

bad4e2e7504f8534458a9d9dd7b1362f
SHA1

1dd40be8446808cc50ac38ff2f82fb0deed19b44
SHA256

c7abdc5c18a0a75619b1b6f931223e019a116bd0489950a328e53411258d3072
SHA512

d8c8f88548b7d17b5560877e2f426d6c762ed94edd99d750767c78ae7391468dcbc73810fc168f77ed8be5290dc0c2213882ddec364b9839b896366d8d9e4418
SSDEEP

384:SDO9CQ5s90+e+rSzHbdO9bZ5KECRmpAPnWIT:ahU5mlMECQCPnfT

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/5020-0-0x00000000756A0000-0x00000000756AE000-memory.dmp	upx
behavioral2/memory/5020-1-0x00000000756A0000-0x00000000756AE000-memory.dmp	upx
behavioral2/memory/5020-2-0x00000000756A0000-0x00000000756AE000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4676	5020	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 5020	212	rundll32.exe	89
PID 212 wrote to memory of 5020	212	rundll32.exe	89
PID 212 wrote to memory of 5020	212	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bad4e2e7504f8534458a9d9dd7b1362f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bad4e2e7504f8534458a9d9dd7b1362f.dll,#1
  2⤵
  PID:5020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 544
    3⤵
    - Program crash
    PID:4676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5020 -ip 5020
1⤵
PID:2128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5020-0-0x00000000756A0000-0x00000000756AE000-memory.dmp

Filesize
56KB

Download
memory/5020-1-0x00000000756A0000-0x00000000756AE000-memory.dmp

Filesize
56KB

Download
memory/5020-2-0x00000000756A0000-0x00000000756AE000-memory.dmp

Filesize
56KB

Download