f9e41fe0854e1d2cba512b09924e117b044f23232e621b02e762a0988b044636 | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 03:07

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/System.dll
Size

7KB
MD5

8b06f277ae47f0d2e1c7098a5657ee88
SHA1

e3802a6f3949b6c8cd058d840b8776ebf587eed2
SHA256

ddccebbf499672af3a74be6fb838b804a66679f7689dde137c39f4e0df1be11d
SHA512

6bb68bd7ce5577ba6460ba2eb11536703d0472ba6f91f2fd9b2ec93128cc2700a426217b1029380a8b98cb823b67959d73edd99b3c3812532530aeae0d928060
SSDEEP

192:Tdfh7NV2z5EBeRSUqc23Kh2mkkxZoPRACMh:vuVEBiqclUa7op8

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral8/memory/2916-0-0x00000000754B0000-0x00000000754B9000-memory.dmp	upx
behavioral8/memory/2916-1-0x00000000754B0000-0x00000000754B9000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4704	2916	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 516 wrote to memory of 2916	516	rundll32.exe	85
PID 516 wrote to memory of 2916	516	rundll32.exe	85
PID 516 wrote to memory of 2916	516	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:516
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  PID:2916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 612
    3⤵
    - Program crash
    PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2916 -ip 2916
1⤵
PID:3076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2916-0-0x00000000754B0000-0x00000000754B9000-memory.dmp

Filesize
36KB

Download
memory/2916-1-0x00000000754B0000-0x00000000754B9000-memory.dmp

Filesize
36KB

Download