2e1a2a85c33066ad5e761382ef3c0e99825978cde12112856a273939af54e2f2

General

Target

2e1a2a85c33066ad5e761382ef3c0e99825978cde12112856a273939af54e2f2.dll
Size

1.0MB
MD5

8f24c6eb4f6118c013c3986c09727d13
SHA1

b5a618aa02cfe64f13dbcaf6cb10d950eb1717e6
SHA256

2e1a2a85c33066ad5e761382ef3c0e99825978cde12112856a273939af54e2f2
SHA512

3057ee45936f065b0c07d5e0034043b76111d46ca886599791ce9eb61ba7feabeccddcd9488fc8e3ee5485c197c56e543e482fe2cb2d5bf014733ca531f19a76
SSDEEP

24576:m/IGoOaZ1qaGw82ZY4S1+A0Sg+fbciFS1+n:uZaZAaTS1WUfhS1Y

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2176-0-0x00000000002E0000-0x000000000031E000-memory.dmp	upx
behavioral1/memory/2176-1-0x00000000002E0000-0x000000000031E000-memory.dmp	upx
behavioral1/memory/2176-3-0x00000000002E0000-0x000000000031E000-memory.dmp	upx
behavioral1/memory/2176-2-0x00000000002E0000-0x000000000031E000-memory.dmp	upx
behavioral1/memory/2176-5-0x00000000002E0000-0x000000000031E000-memory.dmp	upx
behavioral1/memory/2176-7-0x00000000002E0000-0x000000000031E000-memory.dmp	upx
behavioral1/memory/2176-9-0x00000000002E0000-0x000000000031E000-memory.dmp	upx
behavioral1/memory/2176-11-0x00000000002E0000-0x000000000031E000-memory.dmp	upx
behavioral1/memory/2176-13-0x00000000002E0000-0x000000000031E000-memory.dmp	upx
behavioral1/memory/2176-15-0x00000000002E0000-0x000000000031E000-memory.dmp	upx
behavioral1/memory/2176-17-0x00000000002E0000-0x000000000031E000-memory.dmp	upx
behavioral1/memory/2176-19-0x00000000002E0000-0x000000000031E000-memory.dmp	upx
behavioral1/memory/2176-21-0x00000000002E0000-0x000000000031E000-memory.dmp	upx
behavioral1/memory/2176-23-0x00000000002E0000-0x000000000031E000-memory.dmp	upx
behavioral1/memory/2176-25-0x00000000002E0000-0x000000000031E000-memory.dmp	upx
behavioral1/memory/2176-27-0x00000000002E0000-0x000000000031E000-memory.dmp	upx
behavioral1/memory/2176-29-0x00000000002E0000-0x000000000031E000-memory.dmp	upx
behavioral1/memory/2176-31-0x00000000002E0000-0x000000000031E000-memory.dmp	upx
behavioral1/memory/2176-33-0x00000000002E0000-0x000000000031E000-memory.dmp	upx
behavioral1/memory/2176-35-0x00000000002E0000-0x000000000031E000-memory.dmp	upx
behavioral1/memory/2176-37-0x00000000002E0000-0x000000000031E000-memory.dmp	upx
behavioral1/memory/2176-39-0x00000000002E0000-0x000000000031E000-memory.dmp	upx
behavioral1/memory/2176-41-0x00000000002E0000-0x000000000031E000-memory.dmp	upx
behavioral1/memory/2176-43-0x00000000002E0000-0x000000000031E000-memory.dmp	upx
behavioral1/memory/2176-44-0x00000000002E0000-0x000000000031E000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2496	2176	WerFault.exe	28

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2176	rundll32.exe
2176	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 2176	2780	rundll32.exe	28
PID 2780 wrote to memory of 2176	2780	rundll32.exe	28
PID 2780 wrote to memory of 2176	2780	rundll32.exe	28
PID 2780 wrote to memory of 2176	2780	rundll32.exe	28
PID 2780 wrote to memory of 2176	2780	rundll32.exe	28
PID 2780 wrote to memory of 2176	2780	rundll32.exe	28
PID 2780 wrote to memory of 2176	2780	rundll32.exe	28
PID 2176 wrote to memory of 2496	2176	rundll32.exe	29
PID 2176 wrote to memory of 2496	2176	rundll32.exe	29
PID 2176 wrote to memory of 2496	2176	rundll32.exe	29
PID 2176 wrote to memory of 2496	2176	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e1a2a85c33066ad5e761382ef3c0e99825978cde12112856a273939af54e2f2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e1a2a85c33066ad5e761382ef3c0e99825978cde12112856a273939af54e2f2.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 292
    3⤵
    - Program crash
    PID:2496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2176-0-0x00000000002E0000-0x000000000031E000-memory.dmp

Filesize
248KB

Download
memory/2176-1-0x00000000002E0000-0x000000000031E000-memory.dmp

Filesize
248KB

Download
memory/2176-3-0x00000000002E0000-0x000000000031E000-memory.dmp

Filesize
248KB

Download
memory/2176-2-0x00000000002E0000-0x000000000031E000-memory.dmp

Filesize
248KB

Download
memory/2176-5-0x00000000002E0000-0x000000000031E000-memory.dmp

Filesize
248KB

Download
memory/2176-7-0x00000000002E0000-0x000000000031E000-memory.dmp

Filesize
248KB

Download
memory/2176-9-0x00000000002E0000-0x000000000031E000-memory.dmp

Filesize
248KB

Download
memory/2176-11-0x00000000002E0000-0x000000000031E000-memory.dmp

Filesize
248KB

Download
memory/2176-13-0x00000000002E0000-0x000000000031E000-memory.dmp

Filesize
248KB

Download
memory/2176-15-0x00000000002E0000-0x000000000031E000-memory.dmp

Filesize
248KB

Download
memory/2176-17-0x00000000002E0000-0x000000000031E000-memory.dmp

Filesize
248KB

Download
memory/2176-19-0x00000000002E0000-0x000000000031E000-memory.dmp

Filesize
248KB

Download
memory/2176-21-0x00000000002E0000-0x000000000031E000-memory.dmp

Filesize
248KB

Download
memory/2176-23-0x00000000002E0000-0x000000000031E000-memory.dmp

Filesize
248KB

Download
memory/2176-25-0x00000000002E0000-0x000000000031E000-memory.dmp

Filesize
248KB

Download
memory/2176-27-0x00000000002E0000-0x000000000031E000-memory.dmp

Filesize
248KB

Download
memory/2176-29-0x00000000002E0000-0x000000000031E000-memory.dmp

Filesize
248KB

Download
memory/2176-31-0x00000000002E0000-0x000000000031E000-memory.dmp

Filesize
248KB

Download
memory/2176-33-0x00000000002E0000-0x000000000031E000-memory.dmp

Filesize
248KB

Download
memory/2176-35-0x00000000002E0000-0x000000000031E000-memory.dmp

Filesize
248KB

Download
memory/2176-37-0x00000000002E0000-0x000000000031E000-memory.dmp

Filesize
248KB

Download
memory/2176-39-0x00000000002E0000-0x000000000031E000-memory.dmp

Filesize
248KB

Download
memory/2176-41-0x00000000002E0000-0x000000000031E000-memory.dmp

Filesize
248KB

Download
memory/2176-43-0x00000000002E0000-0x000000000031E000-memory.dmp

Filesize
248KB

Download
memory/2176-44-0x00000000002E0000-0x000000000031E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing