4be1fa2da5a383e05e166f95f7299fecc6a43cc1854496bceeae73a16e5eedf8 | Triage

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-03-2024 17:03

Sharing

Report Analysis Logs

General

Target

bf24353e4b7c544fa5f49bf46fe4881e.dll
Size

111KB
MD5

bf24353e4b7c544fa5f49bf46fe4881e
SHA1

1664205bf8245fe886ba8d341d5f4bc182a2e405
SHA256

4be1fa2da5a383e05e166f95f7299fecc6a43cc1854496bceeae73a16e5eedf8
SHA512

c27fd96b6275ea8abbf0bbe5e4ffc29ba71106e5e27d8fde1d5afd64b43b3c3cbee24740c68019b7bfc48012689a58ea4b8ee35cf9fca5b8f1d07d95c54e4192
SSDEEP

3072:dFhw9d6TQvRJ6cVRtPpYzx3Tg8ttMfCiW:ry9d6TQvf6ktPm9g8A65

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/5044-0-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1964	5044	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 5044	2984	rundll32.exe	87
PID 2984 wrote to memory of 5044	2984	rundll32.exe	87
PID 2984 wrote to memory of 5044	2984	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf24353e4b7c544fa5f49bf46fe4881e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf24353e4b7c544fa5f49bf46fe4881e.dll,#1
  2⤵
  PID:5044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 572
    3⤵
    - Program crash
    PID:1964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5044 -ip 5044
1⤵
PID:2816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5044-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download