8d3d217e063fd7b3b11a06376e0a98c989ee1db3977ca2216a4e4616a66bb756 | Triage

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 14:33

Sharing

Report Analysis Logs

General

Target

01313365e67bd6b1ea68bcba2ce5f957.dll
Size

70KB
MD5

01313365e67bd6b1ea68bcba2ce5f957
SHA1

20bbc205d723a23a1fef8171bf590bd58b44e83f
SHA256

8d3d217e063fd7b3b11a06376e0a98c989ee1db3977ca2216a4e4616a66bb756
SHA512

173c4906bab26341f564a70bd025ac38eafe6e2f110a1c2fdb23bbcad0a045d070f37ecd723538514d46db00b5f22dfeee5df64da8bc95e45bc100c13a8e2180
SSDEEP

1536:1JN9N9sJgWOuK7r0PX51W1jz26JoldomKr+FVVKBP/Hn:NH9zP0PW9zbmNWP/H

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2176-3-0x0000000000160000-0x0000000000182000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2176	1720	rundll32.exe	28
PID 1720 wrote to memory of 2176	1720	rundll32.exe	28
PID 1720 wrote to memory of 2176	1720	rundll32.exe	28
PID 1720 wrote to memory of 2176	1720	rundll32.exe	28
PID 1720 wrote to memory of 2176	1720	rundll32.exe	28
PID 1720 wrote to memory of 2176	1720	rundll32.exe	28
PID 1720 wrote to memory of 2176	1720	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01313365e67bd6b1ea68bcba2ce5f957.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01313365e67bd6b1ea68bcba2ce5f957.dll,#1
  2⤵
  PID:2176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2176-0-0x0000000000150000-0x0000000000172000-memory.dmp

Filesize
136KB

Download
memory/2176-1-0x0000000000150000-0x0000000000172000-memory.dmp

Filesize
136KB

Download
memory/2176-2-0x0000000000150000-0x0000000000172000-memory.dmp

Filesize
136KB

Download
memory/2176-3-0x0000000000160000-0x0000000000182000-memory.dmp

Filesize
136KB

Download