6b41f3730dc98a09f4c840a02612e890898f70d7a01a2113b26150f68f113cb7 | Triage

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 23:14

Sharing

Report Analysis Logs

General

Target

189ad49e8363a1ef612f26147992f0eb.dll
Size

63KB
MD5

189ad49e8363a1ef612f26147992f0eb
SHA1

45957c282ec2e0d8c1db1b810d806f3ed998e171
SHA256

6b41f3730dc98a09f4c840a02612e890898f70d7a01a2113b26150f68f113cb7
SHA512

218f95be149de2f2a6cec9ae3ff4cfa34953e963e67e0ac7c385273fb0e5eb67bf562fabca7110ece63d8092749d7d7f2ba75792958291d90d0ca0ee73e5c65f
SSDEEP

1536:HKvv9jeCw6l9n+Eu2LYWX1mt0I4TsGpVLx+P8v5/YHC0f:TSHu2BYup9k8h/YHF

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/3056-0-0x0000000010000000-0x0000000010664000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 3056	3040	rundll32.exe	28
PID 3040 wrote to memory of 3056	3040	rundll32.exe	28
PID 3040 wrote to memory of 3056	3040	rundll32.exe	28
PID 3040 wrote to memory of 3056	3040	rundll32.exe	28
PID 3040 wrote to memory of 3056	3040	rundll32.exe	28
PID 3040 wrote to memory of 3056	3040	rundll32.exe	28
PID 3040 wrote to memory of 3056	3040	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\189ad49e8363a1ef612f26147992f0eb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\189ad49e8363a1ef612f26147992f0eb.dll,#1
  2⤵
  PID:3056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3056-0-0x0000000010000000-0x0000000010664000-memory.dmp

Filesize
6.4MB

Download