07452dce5b9f6c7bda1af84c5c26ca1f0eeed0b562def49f11af9675de91e077

General

Target

07452dce5b9f6c7bda1af84c5c26ca1f0eeed0b562def49f11af9675de91e077.dll
Size

1.0MB
MD5

3545d6ac13e7c2b1cccb1ded9a30d201
SHA1

a712de926d9e7974940ad047611ee510cc29c0e6
SHA256

07452dce5b9f6c7bda1af84c5c26ca1f0eeed0b562def49f11af9675de91e077
SHA512

2ff577ff4bb15d348d97a4bf0932ae73fdc482bbba122c9089e24a3da1e0ffd19e36b50496d7599e6fb3f25959e7c84b36ddee0a5b7c5f702e2dc364f78e2183
SSDEEP

24576:m/IGoOaZ1qaGw82ZY4S1+A0Sg+fbcizhB:uZaZAaTS1WUf3hB

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/628-54-0x00000000007C0000-0x00000000007FE000-memory.dmp	upx
behavioral1/memory/628-55-0x00000000007C0000-0x00000000007FE000-memory.dmp	upx
behavioral1/memory/628-56-0x00000000007C0000-0x00000000007FE000-memory.dmp	upx
behavioral1/memory/628-57-0x00000000007C0000-0x00000000007FE000-memory.dmp	upx
behavioral1/memory/628-59-0x00000000007C0000-0x00000000007FE000-memory.dmp	upx
behavioral1/memory/628-61-0x00000000007C0000-0x00000000007FE000-memory.dmp	upx
behavioral1/memory/628-63-0x00000000007C0000-0x00000000007FE000-memory.dmp	upx
behavioral1/memory/628-65-0x00000000007C0000-0x00000000007FE000-memory.dmp	upx
behavioral1/memory/628-67-0x00000000007C0000-0x00000000007FE000-memory.dmp	upx
behavioral1/memory/628-69-0x00000000007C0000-0x00000000007FE000-memory.dmp	upx
behavioral1/memory/628-71-0x00000000007C0000-0x00000000007FE000-memory.dmp	upx
behavioral1/memory/628-73-0x00000000007C0000-0x00000000007FE000-memory.dmp	upx
behavioral1/memory/628-75-0x00000000007C0000-0x00000000007FE000-memory.dmp	upx
behavioral1/memory/628-77-0x00000000007C0000-0x00000000007FE000-memory.dmp	upx
behavioral1/memory/628-79-0x00000000007C0000-0x00000000007FE000-memory.dmp	upx
behavioral1/memory/628-81-0x00000000007C0000-0x00000000007FE000-memory.dmp	upx
behavioral1/memory/628-83-0x00000000007C0000-0x00000000007FE000-memory.dmp	upx
behavioral1/memory/628-85-0x00000000007C0000-0x00000000007FE000-memory.dmp	upx
behavioral1/memory/628-87-0x00000000007C0000-0x00000000007FE000-memory.dmp	upx
behavioral1/memory/628-89-0x00000000007C0000-0x00000000007FE000-memory.dmp	upx
behavioral1/memory/628-91-0x00000000007C0000-0x00000000007FE000-memory.dmp	upx
behavioral1/memory/628-93-0x00000000007C0000-0x00000000007FE000-memory.dmp	upx
behavioral1/memory/628-95-0x00000000007C0000-0x00000000007FE000-memory.dmp	upx
behavioral1/memory/628-97-0x00000000007C0000-0x00000000007FE000-memory.dmp	upx
behavioral1/memory/628-98-0x00000000007C0000-0x00000000007FE000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2580	628	WerFault.exe	28

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
628	rundll32.exe
628	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 628	2440	rundll32.exe	28
PID 2440 wrote to memory of 628	2440	rundll32.exe	28
PID 2440 wrote to memory of 628	2440	rundll32.exe	28
PID 2440 wrote to memory of 628	2440	rundll32.exe	28
PID 2440 wrote to memory of 628	2440	rundll32.exe	28
PID 2440 wrote to memory of 628	2440	rundll32.exe	28
PID 2440 wrote to memory of 628	2440	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\07452dce5b9f6c7bda1af84c5c26ca1f0eeed0b562def49f11af9675de91e077.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\07452dce5b9f6c7bda1af84c5c26ca1f0eeed0b562def49f11af9675de91e077.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 292
    3⤵
    - Program crash
    PID:2580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/628-54-0x00000000007C0000-0x00000000007FE000-memory.dmp

Filesize
248KB

Download
memory/628-55-0x00000000007C0000-0x00000000007FE000-memory.dmp

Filesize
248KB

Download
memory/628-56-0x00000000007C0000-0x00000000007FE000-memory.dmp

Filesize
248KB

Download
memory/628-57-0x00000000007C0000-0x00000000007FE000-memory.dmp

Filesize
248KB

Download
memory/628-59-0x00000000007C0000-0x00000000007FE000-memory.dmp

Filesize
248KB

Download
memory/628-61-0x00000000007C0000-0x00000000007FE000-memory.dmp

Filesize
248KB

Download
memory/628-63-0x00000000007C0000-0x00000000007FE000-memory.dmp

Filesize
248KB

Download
memory/628-65-0x00000000007C0000-0x00000000007FE000-memory.dmp

Filesize
248KB

Download
memory/628-67-0x00000000007C0000-0x00000000007FE000-memory.dmp

Filesize
248KB

Download
memory/628-69-0x00000000007C0000-0x00000000007FE000-memory.dmp

Filesize
248KB

Download
memory/628-71-0x00000000007C0000-0x00000000007FE000-memory.dmp

Filesize
248KB

Download
memory/628-73-0x00000000007C0000-0x00000000007FE000-memory.dmp

Filesize
248KB

Download
memory/628-75-0x00000000007C0000-0x00000000007FE000-memory.dmp

Filesize
248KB

Download
memory/628-77-0x00000000007C0000-0x00000000007FE000-memory.dmp

Filesize
248KB

Download
memory/628-79-0x00000000007C0000-0x00000000007FE000-memory.dmp

Filesize
248KB

Download
memory/628-81-0x00000000007C0000-0x00000000007FE000-memory.dmp

Filesize
248KB

Download
memory/628-83-0x00000000007C0000-0x00000000007FE000-memory.dmp

Filesize
248KB

Download
memory/628-85-0x00000000007C0000-0x00000000007FE000-memory.dmp

Filesize
248KB

Download
memory/628-87-0x00000000007C0000-0x00000000007FE000-memory.dmp

Filesize
248KB

Download
memory/628-89-0x00000000007C0000-0x00000000007FE000-memory.dmp

Filesize
248KB

Download
memory/628-91-0x00000000007C0000-0x00000000007FE000-memory.dmp

Filesize
248KB

Download
memory/628-93-0x00000000007C0000-0x00000000007FE000-memory.dmp

Filesize
248KB

Download
memory/628-95-0x00000000007C0000-0x00000000007FE000-memory.dmp

Filesize
248KB

Download
memory/628-97-0x00000000007C0000-0x00000000007FE000-memory.dmp

Filesize
248KB

Download
memory/628-98-0x00000000007C0000-0x00000000007FE000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing