Analysis
-
max time kernel
140s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
18/09/2023, 02:29
General
-
Target
ac7804eed165f207297c23ca978c2f21dac27abb3a1b57fc808e367a889d1cc1.dll
-
Size
1.5MB
-
MD5
59a58f5bcf5a14f6923e7e52c4ae954a
-
SHA1
cfa1c1636254680d18f0bda20e3043badae1339e
-
SHA256
ac7804eed165f207297c23ca978c2f21dac27abb3a1b57fc808e367a889d1cc1
-
SHA512
8fa9a8cc055c10cc84a719182e690bb8231cc965837601f131349b10dcc16efd330129f44eee9fe632454244f78e5d76193b52fad37fa9c27f95f7cdd7d44a09
-
SSDEEP
24576:KwALEfb99TUmpqWpNlmxgNpzR5MEDGb8zukgMDQwMHtisk:X9KWpFNp7MuG7gvsk
Score
7/10
Malware Config
Signatures
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 16 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac7804eed165f207297c23ca978c2f21dac27abb3a1b57fc808e367a889d1cc1.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac7804eed165f207297c23ca978c2f21dac27abb3a1b57fc808e367a889d1cc1.dll,#12⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 8603⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3340 -ip 33401⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB