78aa8219eccfab8f69b7131e1402d9684a4385e6f0d84430454f1514e2a0e90b

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 06:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78aa8219eccfab8f69b7131e1402d9684a4385e6f0d84430454f1514e2a0e90b.dll
Size

787KB
MD5

b1158f2e5e67732a887084d236065cf0
SHA1

4aceb3a5a32197f1baf25dfcc2bd2bc4bd208d6d
SHA256

78aa8219eccfab8f69b7131e1402d9684a4385e6f0d84430454f1514e2a0e90b
SHA512

fa2c2a86354776320c04b3109079a913c13134827a8b74300ba0181bb1c23440663c077e1816f7758eaaed767081db8b891cd681fb1049789ef550d65c4afc3c
SSDEEP

24576:Qzb1MlCKUQyUmjtczu6Prs9pgWoopooK9kwPXjZW:QzbKsUmjtcdPGgIwPXY

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

rundll32mgr.exe

pid process

1080 rundll32mgr.exe

pid	process
1080	rundll32mgr.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Windows\SysWOW64\rundll32mgr.exe	upx
\Windows\SysWOW64\rundll32mgr.exe	upx
C:\Windows\SysWOW64\rundll32mgr.exe	upx
behavioral1/memory/1080-60-0x0000000000400000-0x0000000000461000-memory.dmp	upx

Loads dropped DLL 2 IoCs

Processes:

rundll32.exe

pid process

820 rundll32.exe
820 rundll32.exe
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe

pid	process
820	rundll32.exe
820	rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1284 wrote to memory of 820	1284	rundll32.exe	rundll32.exe
PID 1284 wrote to memory of 820	1284	rundll32.exe	rundll32.exe
PID 1284 wrote to memory of 820	1284	rundll32.exe	rundll32.exe
PID 1284 wrote to memory of 820	1284	rundll32.exe	rundll32.exe
PID 1284 wrote to memory of 820	1284	rundll32.exe	rundll32.exe
PID 1284 wrote to memory of 820	1284	rundll32.exe	rundll32.exe
PID 1284 wrote to memory of 820	1284	rundll32.exe	rundll32.exe
PID 820 wrote to memory of 1080	820	rundll32.exe	rundll32mgr.exe
PID 820 wrote to memory of 1080	820	rundll32.exe	rundll32mgr.exe
PID 820 wrote to memory of 1080	820	rundll32.exe	rundll32mgr.exe
PID 820 wrote to memory of 1080	820	rundll32.exe	rundll32mgr.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\78aa8219eccfab8f69b7131e1402d9684a4385e6f0d84430454f1514e2a0e90b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1284

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\78aa8219eccfab8f69b7131e1402d9684a4385e6f0d84430454f1514e2a0e90b.dll,#1
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:820

C:\Windows\SysWOW64\rundll32mgr.exe
C:\Windows\SysWOW64\rundll32mgr.exe
3⤵
- Executes dropped EXE
PID:1080

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\rundll32mgr.exe
Filesize
129KB

MD5
0344a3aa574e9d0e0f5593ed1b4cb88b

SHA1
951fe2b0b4678199676e71838d91dddf762fa79d

SHA256
93f2949add56ea8f8f063c3b313ee701f57a208021fafbe6aac3e9a43a6f3ded

SHA512
31e4f5a15a7d15938cbd80638230ddb2cc3acd5060d99b4ea061fe1f186e6165755f2724c5bfe7b509a42e4a4612c95920f14d509a3f8c7b68b19e994fa7afdc

Download Submit
\Windows\SysWOW64\rundll32mgr.exe
Filesize
129KB

MD5
0344a3aa574e9d0e0f5593ed1b4cb88b

SHA1
951fe2b0b4678199676e71838d91dddf762fa79d

SHA256
93f2949add56ea8f8f063c3b313ee701f57a208021fafbe6aac3e9a43a6f3ded

SHA512
31e4f5a15a7d15938cbd80638230ddb2cc3acd5060d99b4ea061fe1f186e6165755f2724c5bfe7b509a42e4a4612c95920f14d509a3f8c7b68b19e994fa7afdc

Download Submit
\Windows\SysWOW64\rundll32mgr.exe
Filesize
129KB

MD5
0344a3aa574e9d0e0f5593ed1b4cb88b

SHA1
951fe2b0b4678199676e71838d91dddf762fa79d

SHA256
93f2949add56ea8f8f063c3b313ee701f57a208021fafbe6aac3e9a43a6f3ded

SHA512
31e4f5a15a7d15938cbd80638230ddb2cc3acd5060d99b4ea061fe1f186e6165755f2724c5bfe7b509a42e4a4612c95920f14d509a3f8c7b68b19e994fa7afdc

Download Submit
memory/820-54-0x0000000000000000-mapping.dmp

Download
memory/820-55-0x00000000762E1000-0x00000000762E3000-memory.dmp

Filesize
8KB

Download
memory/820-61-0x0000000005000000-0x00000000050CA000-memory.dmp

Filesize
808KB

Download
memory/820-62-0x00000000001C0000-0x0000000000221000-memory.dmp

Filesize
388KB

Download
memory/820-63-0x00000000001C0000-0x0000000000221000-memory.dmp

Filesize
388KB

Download
memory/1080-58-0x0000000000000000-mapping.dmp

Download
memory/1080-60-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads