4be77c019328203bc16fcd6ab62b41e26e14edfdc4572448d0ddb101ba796ec9 | Triage

Analysis

max time kernel
92s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 16:19

Sharing

Report Analysis Logs

General

Target

_ctypes.dll
Size

34KB
MD5

5d030c1056dd9a0ed1cb0c6a23054e55
SHA1

462a3ca9ad9887bb80061f8b3d58d49eaf9ef83a
SHA256

ff601d580fed554a7ff0511a0cd3901ecf1f4fcf9b7534542af659453d95938c
SHA512

1e26eed1ce3913be1beb44828795ef97271094635ebb500bb7304017230558f7e704540a52ade9e78fc260cb4326b8d69fa81fa4f0680eb3b1645e2ddbb00f10
SSDEEP

768:/u3KquBH+UC2piGcytkpFtPMc+jVRQulrVIeOoD99qLCzJ1TU4y:/HVPHLrRQulRIeHpzJy

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral16/memory/436-0-0x0000000074EC0000-0x0000000074EDC000-memory.dmp	upx
behavioral16/memory/436-1-0x0000000074B30000-0x0000000074DF2000-memory.dmp	upx
behavioral16/memory/436-4-0x0000000074EC0000-0x0000000074EDC000-memory.dmp	upx
behavioral16/memory/436-5-0x0000000074B30000-0x0000000074DF2000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5116	436	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 436	3412	rundll32.exe	84
PID 3412 wrote to memory of 436	3412	rundll32.exe	84
PID 3412 wrote to memory of 436	3412	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\_ctypes.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\_ctypes.dll,#1
  2⤵
  PID:436
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 636
    3⤵
    - Program crash
    PID:5116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 436 -ip 436
1⤵
PID:4036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/436-0-0x0000000074EC0000-0x0000000074EDC000-memory.dmp

Filesize
112KB

Download
memory/436-1-0x0000000074B30000-0x0000000074DF2000-memory.dmp

Filesize
2.8MB

Download
memory/436-4-0x0000000074EC0000-0x0000000074EDC000-memory.dmp

Filesize
112KB

Download
memory/436-5-0x0000000074B30000-0x0000000074DF2000-memory.dmp

Filesize
2.8MB

Download