800a5ffb8c05a58c56003e1e20e0c48dcd04dc8145818ba341fb692480c66430 | Triage

Analysis

max time kernel
150s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-03-2024 01:50

Sharing

Report Analysis Logs

General

Target

c2283d07c3750bf6a13b573a81875463.dll
Size

66KB
MD5

c2283d07c3750bf6a13b573a81875463
SHA1

ac4429a7c422c1336403fc10eae1b55afc71f393
SHA256

800a5ffb8c05a58c56003e1e20e0c48dcd04dc8145818ba341fb692480c66430
SHA512

542f37937e0c82ca13c001abc82218839ae452d7caaef315c607ad0d5258995e0b4bbe6643e405a10633f88371924bebc982a5d6615aaf3081e17e1d4736ec61
SSDEEP

1536:SAVJ0mWeB/iU9Qvo/FWX2n0t7gIRizMOBb2a:zJ0mW8/iTotWXdtcIRizMOd

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4652-0-0x0000000010000000-0x000000001000C000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 4652	1704	rundll32.exe	94
PID 1704 wrote to memory of 4652	1704	rundll32.exe	94
PID 1704 wrote to memory of 4652	1704	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c2283d07c3750bf6a13b573a81875463.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c2283d07c3750bf6a13b573a81875463.dll,#1
  2⤵
  PID:4652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=3044,i,17059189006398306756,4247826696353232857,262144 --variations-seed-version /prefetch:8
1⤵
PID:2380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4652-0-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download