e51bac091a171091098a61a2706c410ff7896d04f1f82bcec6c8b42447544805 | Triage

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:50

Sharing

Report Analysis Logs

General

Target

KailleraClient.dll
Size

31KB
MD5

556d7b02a310438694ef2c99a6f916c0
SHA1

54dccd82fea94544012963c32eeb491dd5253234
SHA256

ef92ab4990079626ad402537ba05a9116ef48f1734081a433c5a5edc6ae79706
SHA512

890c6bcdce98d774162567dd739f54ab3a5c9d3562c19296a9cab752d73022c38491a4e1aa365c896cc62d7862fbd75f1b3e29d60eb088d555181c13dd045e9b
SSDEEP

768:2diLLbKGYg0H17PJc/3zJlQpn2YPrAR5tfP5k0cb/:KKXOP17PerAY+ARDBLk/

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral24/memory/3540-0-0x0000000010000000-0x0000000010017000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4600 wrote to memory of 3540	4600	rundll32.exe	rundll32.exe
PID 4600 wrote to memory of 3540	4600	rundll32.exe	rundll32.exe
PID 4600 wrote to memory of 3540	4600	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\KailleraClient.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4600

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\KailleraClient.dll,#1
2⤵
PID:3540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3540-0-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download