0558fb1ceb03dc50b23593f6b41f0352d1cce54954bd1fc1ad111be989f2ebd4 | Triage

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 14:41

Sharing

Report Analysis Logs

General

Target

cbac9b7a45896f7b648bf3950ac3c4ab.dll
Size

29KB
MD5

cbac9b7a45896f7b648bf3950ac3c4ab
SHA1

91aa579bae35c2078d29e4793c5f84cfcca7c583
SHA256

0558fb1ceb03dc50b23593f6b41f0352d1cce54954bd1fc1ad111be989f2ebd4
SHA512

3888a340a4f156f7a024c00c57024e837aa41c42910a29056beb0dd16f552da0b560685fbcb6259b2b5302c8f4d7d916bc3da6045455887fb6fabcedc2e3a982
SSDEEP

768:gBaLxv5KPsZuHof2RrMGB1Wh0NAQh2hHz32zzsMASZcVU:GaCPo+WSnwhT36ASeU

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2940-0-0x0000000010000000-0x0000000010015000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2940	3008	rundll32.exe	90
PID 3008 wrote to memory of 2940	3008	rundll32.exe	90
PID 3008 wrote to memory of 2940	3008	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbac9b7a45896f7b648bf3950ac3c4ab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbac9b7a45896f7b648bf3950ac3c4ab.dll,#1
  2⤵
  PID:2940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2940-0-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download