d21665dfe3585e46c95bfe5ba45495e8ceccce3e2bc92fd993bbfaa011a216a5 | Triage

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 18:54

Sharing

Report Analysis Logs

General

Target

I386/SYSTEM32/DESKMON.dll
Size

11KB
MD5

9697a6c740706e55920a424f55b8fa85
SHA1

8f7195744eefb239d65cd69799692b6b34e3463e
SHA256

f847988b998765389288fe864e620680c6df83d800dc630ec3ae7114433a2b08
SHA512

fc78d67fd78d6031c23e0f5d2b1ae7f585bdc1d68214604967c17318a3f4b26bfdb5a772653ae20ba9e29e98e9c16cf808345a24231dcea675cf36858b9a5858
SSDEEP

192:T/zIXmXmmG4IZR7FtvMKFJeR7g5jTnunktHxYW2aA0WrpBrx:/IXmXmL4IZzSKyR0VAWrA0WHx

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral18/memory/4752-0-0x000000006D400000-0x000000006D40A000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 4752	4648	rundll32.exe	85
PID 4648 wrote to memory of 4752	4648	rundll32.exe	85
PID 4648 wrote to memory of 4752	4648	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\I386\SYSTEM32\DESKMON.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\I386\SYSTEM32\DESKMON.dll,#1
  2⤵
  PID:4752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4752-0-0x000000006D400000-0x000000006D40A000-memory.dmp

Filesize
40KB

Download