Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
12/10/2023, 07:50
General
-
Target
f35a4c795921a5cb233ef2bda07c95d25838f310d4ffbf3ac648869b4a816007.dll
-
Size
3.8MB
-
MD5
5e53980faa485079efa6c4086c616e4c
-
SHA1
842cf038f0c4888fbafa3a047bedb453938c812f
-
SHA256
f35a4c795921a5cb233ef2bda07c95d25838f310d4ffbf3ac648869b4a816007
-
SHA512
2fb205b51183d50c384b1abd916122d7376dcae9f41fc89f45811cb629d9446b8ce220f85e49b052f5a6759c871744d1aa2fbf524e3452eb20977fb54dc34b18
-
SSDEEP
98304:DzlTfsrvk6+MeL0N/JWbC294DLdZLBYPNYVyqydxjvZq:DzlDsbaMeL0BJWbCE2LdYuSdx9q
Score
7/10
Malware Config
Signatures
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f35a4c795921a5cb233ef2bda07c95d25838f310d4ffbf3ac648869b4a816007.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f35a4c795921a5cb233ef2bda07c95d25838f310d4ffbf3ac648869b4a816007.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
8.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
44KB
-
Filesize
8.7MB
-
Filesize
44KB