809eb0570ba5abcd4ab012b354b4e1f0311eff595b1988ab0735bf1ab846e632 | Triage

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 14:04

Sharing

Report Analysis Logs

General

Target

FunKoala64.dll
Size

215KB
MD5

eb36b2f6ea7f89d08ba61075c8a37302
SHA1

fb983dbfe4b0cb5981bdd9cc4d319ebbfd85b399
SHA256

318a9b06f8739e3d778865c4800c443031d74e47fc866f159a4acb8b136c8647
SHA512

a98d64549caf32c432404a2540a88a6a9691e2ef7da9ebba314f8cf884685e5f753f26b3822e7138b12ff38f88e4423b11200acfa98087ea0256c7ac133135c4
SSDEEP

6144:LK/6cntv2KAM22WqmooDebfVXQpKeXaBtCEGx:eyktv2OWqf6+hQpOYvx

Score

8^/10

upx

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
7	4784	rundll32.exe
25	4784	rundll32.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral24/memory/4784-0-0x00007FF86B720000-0x00007FF86B7B3000-memory.dmp	upx
behavioral24/memory/4784-1-0x00007FF86B720000-0x00007FF86B7B3000-memory.dmp	upx
behavioral24/memory/4784-2-0x00007FF86B720000-0x00007FF86B7B3000-memory.dmp	upx

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FunKoala64.dll,#1
1⤵
- Blocklisted process makes network request
PID:4784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4784-0-0x00007FF86B720000-0x00007FF86B7B3000-memory.dmp

Filesize
588KB

Download
memory/4784-1-0x00007FF86B720000-0x00007FF86B7B3000-memory.dmp

Filesize
588KB

Download
memory/4784-2-0x00007FF86B720000-0x00007FF86B7B3000-memory.dmp

Filesize
588KB

Download