Analysis
-
max time kernel
69s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
07/12/2022, 01:02
General
-
Target
833ff36a0268a08c164f2081cd98d0cf72d9538c35fcfe612393f70e48b8eef7.dll
-
Size
1.7MB
-
MD5
2b538b55f96234e3d5a853b51347fe3b
-
SHA1
e3b87db16657d377f122aedd8344d137cc0f8dc2
-
SHA256
833ff36a0268a08c164f2081cd98d0cf72d9538c35fcfe612393f70e48b8eef7
-
SHA512
6890df0c5fa0f0489174418fedba2a28b7a5ea721ec6f12ee0a46d576d650cc8db586ae926eea0e56fdcc6398ef000c927ff0eb3e5dba934e45c0a35a08cf43c
-
SSDEEP
49152:tGwZOgFHyVStr0bjJtf7iKgZCf9aEn5PEeVgqad:E2bFmStr0bjJJ77gZCFaY+fn
Score
8/10
Malware Config
Signatures
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious use of SetWindowsHookEx 26 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\833ff36a0268a08c164f2081cd98d0cf72d9538c35fcfe612393f70e48b8eef7.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\833ff36a0268a08c164f2081cd98d0cf72d9538c35fcfe612393f70e48b8eef7.dll,#12⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB