Analysis
-
max time kernel
146s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
11/10/2023, 21:14
General
-
Target
1789d1694c9fe261fc500f6e4c122f44995491494d3d0f4fb9664187ca6948f9.dll
-
Size
3.8MB
-
MD5
2829f6f0cb24ced76ec41b94a5152c81
-
SHA1
6c2c89794df11f0bad2a92a629fa56d6a0d67ffe
-
SHA256
1789d1694c9fe261fc500f6e4c122f44995491494d3d0f4fb9664187ca6948f9
-
SHA512
e2d6218ac6ce862ee71278bd8e692b7bdea8409b6bfc4c8dd9bc2774e2dc385c9ba1526eb9c8dca19b1c4de752df0b0c6a3b00708702f5d843a195bea69c0db6
-
SSDEEP
98304:iC3yMLvSa0gBpuyFzCjk9gkPKV/sTIwBzW9feYK0CessEi:HyM7L0ep/9gOKV7Y0K0CyZ
Score
7/10
Malware Config
Signatures
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1789d1694c9fe261fc500f6e4c122f44995491494d3d0f4fb9664187ca6948f9.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1789d1694c9fe261fc500f6e4c122f44995491494d3d0f4fb9664187ca6948f9.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8.7MB
-
Filesize
4KB
-
Filesize
44KB
-
Filesize
8.7MB
-
Filesize
44KB