fd9d8acef60fa4135fa0c4faab3c9b5309e61a956fd892307a2aafff2f61dea2

General

Target

fd9d8acef60fa4135fa0c4faab3c9b5309e61a956fd892307a2aafff2f61dea2.dll
Size

1.5MB
MD5

568b30c866e266183da4fb961cf230c2
SHA1

cd5870e83e1c1e16a46d3429d7077db19e3e6cbc
SHA256

fd9d8acef60fa4135fa0c4faab3c9b5309e61a956fd892307a2aafff2f61dea2
SHA512

ee5456226e6a4df00f1207b77daeda80b42e9d656ddf301787f9b4e27d916471669caa346aa773fef9c96571de7d2a34ac2b426e8f4931a55ea5d24278302734
SSDEEP

24576:GvrIaujE5ae2tKBmW5CqY5xs2D58GALbwk+E8Fcc:GG5qj2D5Me

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2200-10-0x0000000000200000-0x000000000023E000-memory.dmp	upx
behavioral1/memory/2200-9-0x0000000000200000-0x000000000023E000-memory.dmp	upx
behavioral1/memory/2200-11-0x0000000000200000-0x000000000023E000-memory.dmp	upx
behavioral1/memory/2200-12-0x0000000000200000-0x000000000023E000-memory.dmp	upx
behavioral1/memory/2200-14-0x0000000000200000-0x000000000023E000-memory.dmp	upx
behavioral1/memory/2200-16-0x0000000000200000-0x000000000023E000-memory.dmp	upx
behavioral1/memory/2200-18-0x0000000000200000-0x000000000023E000-memory.dmp	upx
behavioral1/memory/2200-20-0x0000000000200000-0x000000000023E000-memory.dmp	upx
behavioral1/memory/2200-22-0x0000000000200000-0x000000000023E000-memory.dmp	upx
behavioral1/memory/2200-24-0x0000000000200000-0x000000000023E000-memory.dmp	upx
behavioral1/memory/2200-26-0x0000000000200000-0x000000000023E000-memory.dmp	upx
behavioral1/memory/2200-28-0x0000000000200000-0x000000000023E000-memory.dmp	upx
behavioral1/memory/2200-30-0x0000000000200000-0x000000000023E000-memory.dmp	upx
behavioral1/memory/2200-32-0x0000000000200000-0x000000000023E000-memory.dmp	upx
behavioral1/memory/2200-34-0x0000000000200000-0x000000000023E000-memory.dmp	upx
behavioral1/memory/2200-36-0x0000000000200000-0x000000000023E000-memory.dmp	upx
behavioral1/memory/2200-38-0x0000000000200000-0x000000000023E000-memory.dmp	upx
behavioral1/memory/2200-40-0x0000000000200000-0x000000000023E000-memory.dmp	upx
behavioral1/memory/2200-42-0x0000000000200000-0x000000000023E000-memory.dmp	upx
behavioral1/memory/2200-44-0x0000000000200000-0x000000000023E000-memory.dmp	upx
behavioral1/memory/2200-46-0x0000000000200000-0x000000000023E000-memory.dmp	upx
behavioral1/memory/2200-48-0x0000000000200000-0x000000000023E000-memory.dmp	upx
behavioral1/memory/2200-50-0x0000000000200000-0x000000000023E000-memory.dmp	upx
behavioral1/memory/2200-52-0x0000000000200000-0x000000000023E000-memory.dmp	upx
behavioral1/memory/2200-53-0x0000000000200000-0x000000000023E000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2200	rundll32.exe
2200	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2200	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2200	rundll32.exe
2200	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2200	2684	rundll32.exe	28
PID 2684 wrote to memory of 2200	2684	rundll32.exe	28
PID 2684 wrote to memory of 2200	2684	rundll32.exe	28
PID 2684 wrote to memory of 2200	2684	rundll32.exe	28
PID 2684 wrote to memory of 2200	2684	rundll32.exe	28
PID 2684 wrote to memory of 2200	2684	rundll32.exe	28
PID 2684 wrote to memory of 2200	2684	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd9d8acef60fa4135fa0c4faab3c9b5309e61a956fd892307a2aafff2f61dea2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd9d8acef60fa4135fa0c4faab3c9b5309e61a956fd892307a2aafff2f61dea2.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2200-10-0x0000000000200000-0x000000000023E000-memory.dmp

Filesize
248KB

Download
memory/2200-9-0x0000000000200000-0x000000000023E000-memory.dmp

Filesize
248KB

Download
memory/2200-11-0x0000000000200000-0x000000000023E000-memory.dmp

Filesize
248KB

Download
memory/2200-12-0x0000000000200000-0x000000000023E000-memory.dmp

Filesize
248KB

Download
memory/2200-14-0x0000000000200000-0x000000000023E000-memory.dmp

Filesize
248KB

Download
memory/2200-16-0x0000000000200000-0x000000000023E000-memory.dmp

Filesize
248KB

Download
memory/2200-18-0x0000000000200000-0x000000000023E000-memory.dmp

Filesize
248KB

Download
memory/2200-20-0x0000000000200000-0x000000000023E000-memory.dmp

Filesize
248KB

Download
memory/2200-22-0x0000000000200000-0x000000000023E000-memory.dmp

Filesize
248KB

Download
memory/2200-24-0x0000000000200000-0x000000000023E000-memory.dmp

Filesize
248KB

Download
memory/2200-26-0x0000000000200000-0x000000000023E000-memory.dmp

Filesize
248KB

Download
memory/2200-28-0x0000000000200000-0x000000000023E000-memory.dmp

Filesize
248KB

Download
memory/2200-30-0x0000000000200000-0x000000000023E000-memory.dmp

Filesize
248KB

Download
memory/2200-32-0x0000000000200000-0x000000000023E000-memory.dmp

Filesize
248KB

Download
memory/2200-34-0x0000000000200000-0x000000000023E000-memory.dmp

Filesize
248KB

Download
memory/2200-36-0x0000000000200000-0x000000000023E000-memory.dmp

Filesize
248KB

Download
memory/2200-38-0x0000000000200000-0x000000000023E000-memory.dmp

Filesize
248KB

Download
memory/2200-40-0x0000000000200000-0x000000000023E000-memory.dmp

Filesize
248KB

Download
memory/2200-42-0x0000000000200000-0x000000000023E000-memory.dmp

Filesize
248KB

Download
memory/2200-44-0x0000000000200000-0x000000000023E000-memory.dmp

Filesize
248KB

Download
memory/2200-46-0x0000000000200000-0x000000000023E000-memory.dmp

Filesize
248KB

Download
memory/2200-48-0x0000000000200000-0x000000000023E000-memory.dmp

Filesize
248KB

Download
memory/2200-50-0x0000000000200000-0x000000000023E000-memory.dmp

Filesize
248KB

Download
memory/2200-52-0x0000000000200000-0x000000000023E000-memory.dmp

Filesize
248KB

Download
memory/2200-53-0x0000000000200000-0x000000000023E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing