e618f09e815f083807ce8db45cd17dc60e2ce4f6ee39fb5b287d2018993fb773 | Triage

Analysis

max time kernel
133s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08-05-2024 03:59

Sharing

Report Analysis Logs

General

Target

e618f09e815f083807ce8db45cd17dc60e2ce4f6ee39fb5b287d2018993fb773.dll
Size

2KB
MD5

356157e41545f8bd505e9dcb9f5a4093
SHA1

e8ab602eafabcfb7694cd474abbae4ed9346a72c
SHA256

e618f09e815f083807ce8db45cd17dc60e2ce4f6ee39fb5b287d2018993fb773
SHA512

4f7e19e38e25aa1eefd780c697b905d42e96870f84420743984751785c2c2ffa6cc9649e24275c19120589e83902370c7ab01969e7215a7e8831616158295f73

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/4364-0-0x0000000010000000-0x0000000010122000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1656 4364 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3548 wrote to memory of 4364	3548	rundll32.exe	rundll32.exe
PID 3548 wrote to memory of 4364	3548	rundll32.exe	rundll32.exe
PID 3548 wrote to memory of 4364	3548	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e618f09e815f083807ce8db45cd17dc60e2ce4f6ee39fb5b287d2018993fb773.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3548

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e618f09e815f083807ce8db45cd17dc60e2ce4f6ee39fb5b287d2018993fb773.dll,#1
2⤵
PID:4364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 544
3⤵
- Program crash
PID:1656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4364 -ip 4364
1⤵
PID:1944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4364-0-0x0000000010000000-0x0000000010122000-memory.dmp

Filesize
1.1MB

Download