2f1df62cfd8f92f46a8b26d05fbb850bb50db90b4efc7799e6e7b90bfa9f1ac3 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 03:48

Sharing

Report Analysis Logs

General

Target

ZhuodashiResource/HttpFtp.dll
Size

231KB
MD5

e6aba56f32bd92b79e82dd2b9c7cf716
SHA1

12c4bb6b8a6489a16d9f10baf8a210917ca82949
SHA256

f18dde9e8179a99b26e8b652fbe9ce34da99d131b3a7ff1eb6f2555b0eabfb27
SHA512

8aa5c77c4bc3b6d7515c84422d136ae5da3c3115de48bc9bebf8b2db75f6f4bb7db9afa6c4aaf7d41cda56eea4561156affd19dad65f64748e9637061e0a900b
SSDEEP

6144:Cf3QOcagDrJ2C8QIlbEDWaKPPEOBg14ZOHYxmKWI:+AOgJ2oa+WlPPEOB2QmKWI

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1708-0-0x0000000010000000-0x000000001008B000-memory.dmp	upx
behavioral1/memory/1708-2-0x0000000010000000-0x000000001008B000-memory.dmp	upx
behavioral1/memory/1708-1-0x0000000010000000-0x000000001008B000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 1708	2168	rundll32.exe	16
PID 2168 wrote to memory of 1708	2168	rundll32.exe	16
PID 2168 wrote to memory of 1708	2168	rundll32.exe	16
PID 2168 wrote to memory of 1708	2168	rundll32.exe	16
PID 2168 wrote to memory of 1708	2168	rundll32.exe	16
PID 2168 wrote to memory of 1708	2168	rundll32.exe	16
PID 2168 wrote to memory of 1708	2168	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZhuodashiResource\HttpFtp.dll,#1
1⤵
PID:1708

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZhuodashiResource\HttpFtp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1708-0-0x0000000010000000-0x000000001008B000-memory.dmp

Filesize
556KB

Download
memory/1708-2-0x0000000010000000-0x000000001008B000-memory.dmp

Filesize
556KB

Download
memory/1708-1-0x0000000010000000-0x000000001008B000-memory.dmp

Filesize
556KB

Download