3eb979a6ff1812d396023895f4bd563591ade7c57fed2a425cc63bd35d73593d

General

Target

3eb979a6ff1812d396023895f4bd563591ade7c57fed2a425cc63bd35d73593d.dll
Size

1.5MB
MD5

c362d65fc69f52b912c48747dc8c8441
SHA1

701da3f5192a695e1106b11403f76c8522a1dc51
SHA256

3eb979a6ff1812d396023895f4bd563591ade7c57fed2a425cc63bd35d73593d
SHA512

ce56d431e9f4d994b7cd40867354b57bceda0fc5c143927da5c0dd7eecf1ed2c8c98f6d7a30b0f0f4a73f10a6a2f94bf9b67f0417316a8d6f6c4ab44a10d2403
SSDEEP

24576:BdY+HxculZxvcUtF9F0awYOT+K9bMCqFJOJ:PrlbF9m+K9QCqW

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1388-56-0x0000000000180000-0x00000000001BE000-memory.dmp	upx
behavioral1/memory/1388-57-0x0000000000180000-0x00000000001BE000-memory.dmp	upx
behavioral1/memory/1388-58-0x0000000000180000-0x00000000001BE000-memory.dmp	upx
behavioral1/memory/1388-60-0x0000000000180000-0x00000000001BE000-memory.dmp	upx
behavioral1/memory/1388-62-0x0000000000180000-0x00000000001BE000-memory.dmp	upx
behavioral1/memory/1388-64-0x0000000000180000-0x00000000001BE000-memory.dmp	upx
behavioral1/memory/1388-66-0x0000000000180000-0x00000000001BE000-memory.dmp	upx
behavioral1/memory/1388-84-0x0000000000180000-0x00000000001BE000-memory.dmp	upx
behavioral1/memory/1388-90-0x0000000000180000-0x00000000001BE000-memory.dmp	upx
behavioral1/memory/1388-92-0x0000000000180000-0x00000000001BE000-memory.dmp	upx
behavioral1/memory/1388-96-0x0000000000180000-0x00000000001BE000-memory.dmp	upx
behavioral1/memory/1388-94-0x0000000000180000-0x00000000001BE000-memory.dmp	upx
behavioral1/memory/1388-98-0x0000000000180000-0x00000000001BE000-memory.dmp	upx
behavioral1/memory/1388-88-0x0000000000180000-0x00000000001BE000-memory.dmp	upx
behavioral1/memory/1388-99-0x0000000000180000-0x00000000001BE000-memory.dmp	upx
behavioral1/memory/1388-86-0x0000000000180000-0x00000000001BE000-memory.dmp	upx
behavioral1/memory/1388-82-0x0000000000180000-0x00000000001BE000-memory.dmp	upx
behavioral1/memory/1388-80-0x0000000000180000-0x00000000001BE000-memory.dmp	upx
behavioral1/memory/1388-78-0x0000000000180000-0x00000000001BE000-memory.dmp	upx
behavioral1/memory/1388-76-0x0000000000180000-0x00000000001BE000-memory.dmp	upx
behavioral1/memory/1388-74-0x0000000000180000-0x00000000001BE000-memory.dmp	upx
behavioral1/memory/1388-72-0x0000000000180000-0x00000000001BE000-memory.dmp	upx
behavioral1/memory/1388-70-0x0000000000180000-0x00000000001BE000-memory.dmp	upx
behavioral1/memory/1388-68-0x0000000000180000-0x00000000001BE000-memory.dmp	upx

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
460	Process not Found

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1388	rundll32.exe
1388	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3eb979a6ff1812d396023895f4bd563591ade7c57fed2a425cc63bd35d73593d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3eb979a6ff1812d396023895f4bd563591ade7c57fed2a425cc63bd35d73593d.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1388-55-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/1388-56-0x0000000000180000-0x00000000001BE000-memory.dmp

Filesize
248KB

Download
memory/1388-57-0x0000000000180000-0x00000000001BE000-memory.dmp

Filesize
248KB

Download
memory/1388-58-0x0000000000180000-0x00000000001BE000-memory.dmp

Filesize
248KB

Download
memory/1388-60-0x0000000000180000-0x00000000001BE000-memory.dmp

Filesize
248KB

Download
memory/1388-62-0x0000000000180000-0x00000000001BE000-memory.dmp

Filesize
248KB

Download
memory/1388-64-0x0000000000180000-0x00000000001BE000-memory.dmp

Filesize
248KB

Download
memory/1388-66-0x0000000000180000-0x00000000001BE000-memory.dmp

Filesize
248KB

Download
memory/1388-84-0x0000000000180000-0x00000000001BE000-memory.dmp

Filesize
248KB

Download
memory/1388-90-0x0000000000180000-0x00000000001BE000-memory.dmp

Filesize
248KB

Download
memory/1388-92-0x0000000000180000-0x00000000001BE000-memory.dmp

Filesize
248KB

Download
memory/1388-96-0x0000000000180000-0x00000000001BE000-memory.dmp

Filesize
248KB

Download
memory/1388-94-0x0000000000180000-0x00000000001BE000-memory.dmp

Filesize
248KB

Download
memory/1388-98-0x0000000000180000-0x00000000001BE000-memory.dmp

Filesize
248KB

Download
memory/1388-88-0x0000000000180000-0x00000000001BE000-memory.dmp

Filesize
248KB

Download
memory/1388-99-0x0000000000180000-0x00000000001BE000-memory.dmp

Filesize
248KB

Download
memory/1388-86-0x0000000000180000-0x00000000001BE000-memory.dmp

Filesize
248KB

Download
memory/1388-82-0x0000000000180000-0x00000000001BE000-memory.dmp

Filesize
248KB

Download
memory/1388-80-0x0000000000180000-0x00000000001BE000-memory.dmp

Filesize
248KB

Download
memory/1388-78-0x0000000000180000-0x00000000001BE000-memory.dmp

Filesize
248KB

Download
memory/1388-76-0x0000000000180000-0x00000000001BE000-memory.dmp

Filesize
248KB

Download
memory/1388-74-0x0000000000180000-0x00000000001BE000-memory.dmp

Filesize
248KB

Download
memory/1388-72-0x0000000000180000-0x00000000001BE000-memory.dmp

Filesize
248KB

Download
memory/1388-70-0x0000000000180000-0x00000000001BE000-memory.dmp

Filesize
248KB

Download
memory/1388-68-0x0000000000180000-0x00000000001BE000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing