af2a5775183e5a8a527d90907b1ea1299b2f1f06387eaa996912d9b6bbc82ab3

General

Target

af2a5775183e5a8a527d90907b1ea1299b2f1f06387eaa996912d9b6bbc82ab3.dll
Size

1.5MB
MD5

76a31f35e496f7e3b5d04f77f7c0e540
SHA1

b62b0f7559e3e771c31ef35894f8861b5b516e2c
SHA256

af2a5775183e5a8a527d90907b1ea1299b2f1f06387eaa996912d9b6bbc82ab3
SHA512

4b206cc35c9147853fb4c628130be020bd3d91745eefd838bea801465947a914927941a1e68301d7f759583853301f52e4dfe59db2903b0e2e7826d6b2baf03d
SSDEEP

24576:gtR32wnXkv4sDEdYgoFs5a3yRvbLPgzK+QetsL+Q:gtkCjdYq5RRv3I7Q7

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1672-56-0x0000000000210000-0x000000000024F000-memory.dmp	upx
behavioral1/memory/1672-58-0x0000000000210000-0x000000000024F000-memory.dmp	upx
behavioral1/memory/1672-57-0x0000000000210000-0x000000000024F000-memory.dmp	upx
behavioral1/memory/1672-60-0x0000000000210000-0x000000000024F000-memory.dmp	upx
behavioral1/memory/1672-62-0x0000000000210000-0x000000000024F000-memory.dmp	upx
behavioral1/memory/1672-64-0x0000000000210000-0x000000000024F000-memory.dmp	upx
behavioral1/memory/1672-66-0x0000000000210000-0x000000000024F000-memory.dmp	upx
behavioral1/memory/1672-68-0x0000000000210000-0x000000000024F000-memory.dmp	upx
behavioral1/memory/1672-70-0x0000000000210000-0x000000000024F000-memory.dmp	upx
behavioral1/memory/1672-72-0x0000000000210000-0x000000000024F000-memory.dmp	upx
behavioral1/memory/1672-74-0x0000000000210000-0x000000000024F000-memory.dmp	upx
behavioral1/memory/1672-76-0x0000000000210000-0x000000000024F000-memory.dmp	upx
behavioral1/memory/1672-78-0x0000000000210000-0x000000000024F000-memory.dmp	upx
behavioral1/memory/1672-80-0x0000000000210000-0x000000000024F000-memory.dmp	upx
behavioral1/memory/1672-82-0x0000000000210000-0x000000000024F000-memory.dmp	upx
behavioral1/memory/1672-84-0x0000000000210000-0x000000000024F000-memory.dmp	upx
behavioral1/memory/1672-86-0x0000000000210000-0x000000000024F000-memory.dmp	upx
behavioral1/memory/1672-88-0x0000000000210000-0x000000000024F000-memory.dmp	upx
behavioral1/memory/1672-92-0x0000000000210000-0x000000000024F000-memory.dmp	upx
behavioral1/memory/1672-90-0x0000000000210000-0x000000000024F000-memory.dmp	upx
behavioral1/memory/1672-94-0x0000000000210000-0x000000000024F000-memory.dmp	upx
behavioral1/memory/1672-96-0x0000000000210000-0x000000000024F000-memory.dmp	upx
behavioral1/memory/1672-98-0x0000000000210000-0x000000000024F000-memory.dmp	upx
behavioral1/memory/1672-99-0x0000000000210000-0x000000000024F000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1672	rundll32.exe
1672	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 1672	1380	rundll32.exe	27
PID 1380 wrote to memory of 1672	1380	rundll32.exe	27
PID 1380 wrote to memory of 1672	1380	rundll32.exe	27
PID 1380 wrote to memory of 1672	1380	rundll32.exe	27
PID 1380 wrote to memory of 1672	1380	rundll32.exe	27
PID 1380 wrote to memory of 1672	1380	rundll32.exe	27
PID 1380 wrote to memory of 1672	1380	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af2a5775183e5a8a527d90907b1ea1299b2f1f06387eaa996912d9b6bbc82ab3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\af2a5775183e5a8a527d90907b1ea1299b2f1f06387eaa996912d9b6bbc82ab3.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1672-55-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/1672-56-0x0000000000210000-0x000000000024F000-memory.dmp

Filesize
252KB

Download
memory/1672-58-0x0000000000210000-0x000000000024F000-memory.dmp

Filesize
252KB

Download
memory/1672-57-0x0000000000210000-0x000000000024F000-memory.dmp

Filesize
252KB

Download
memory/1672-60-0x0000000000210000-0x000000000024F000-memory.dmp

Filesize
252KB

Download
memory/1672-62-0x0000000000210000-0x000000000024F000-memory.dmp

Filesize
252KB

Download
memory/1672-64-0x0000000000210000-0x000000000024F000-memory.dmp

Filesize
252KB

Download
memory/1672-66-0x0000000000210000-0x000000000024F000-memory.dmp

Filesize
252KB

Download
memory/1672-68-0x0000000000210000-0x000000000024F000-memory.dmp

Filesize
252KB

Download
memory/1672-70-0x0000000000210000-0x000000000024F000-memory.dmp

Filesize
252KB

Download
memory/1672-72-0x0000000000210000-0x000000000024F000-memory.dmp

Filesize
252KB

Download
memory/1672-74-0x0000000000210000-0x000000000024F000-memory.dmp

Filesize
252KB

Download
memory/1672-76-0x0000000000210000-0x000000000024F000-memory.dmp

Filesize
252KB

Download
memory/1672-78-0x0000000000210000-0x000000000024F000-memory.dmp

Filesize
252KB

Download
memory/1672-80-0x0000000000210000-0x000000000024F000-memory.dmp

Filesize
252KB

Download
memory/1672-82-0x0000000000210000-0x000000000024F000-memory.dmp

Filesize
252KB

Download
memory/1672-84-0x0000000000210000-0x000000000024F000-memory.dmp

Filesize
252KB

Download
memory/1672-86-0x0000000000210000-0x000000000024F000-memory.dmp

Filesize
252KB

Download
memory/1672-88-0x0000000000210000-0x000000000024F000-memory.dmp

Filesize
252KB

Download
memory/1672-92-0x0000000000210000-0x000000000024F000-memory.dmp

Filesize
252KB

Download
memory/1672-90-0x0000000000210000-0x000000000024F000-memory.dmp

Filesize
252KB

Download
memory/1672-94-0x0000000000210000-0x000000000024F000-memory.dmp

Filesize
252KB

Download
memory/1672-96-0x0000000000210000-0x000000000024F000-memory.dmp

Filesize
252KB

Download
memory/1672-98-0x0000000000210000-0x000000000024F000-memory.dmp

Filesize
252KB

Download
memory/1672-99-0x0000000000210000-0x000000000024F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing