ade646a3c7ce26dd69073a95963cb000635a2f655a7397c358258daabc057d43 | Triage

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 20:42

Sharing

Report Analysis Logs

General

Target

119c7e9307b2eda2e457ae0fc2d23b2c.dll
Size

97KB
MD5

119c7e9307b2eda2e457ae0fc2d23b2c
SHA1

17bb5e773fc92ca32b406cbc37e468a23959469f
SHA256

ade646a3c7ce26dd69073a95963cb000635a2f655a7397c358258daabc057d43
SHA512

7cd8db9ae31bc44d409ec9dd4b2cc28c5ff248b046a67fc2a6855c39d45868d2c7bf53e7a64016c40d283be65a72df97c6411c17644842619e657c3c3e798f4c
SSDEEP

3072:BbmMjkplNcxmOaLvBX5cmBCTLuP8VvbHeZax2a/:JmMe7cEOaLvkVW8peC/

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2092-0-0x0000000010000000-0x000000001002C000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2092	2984	rundll32.exe	16
PID 2984 wrote to memory of 2092	2984	rundll32.exe	16
PID 2984 wrote to memory of 2092	2984	rundll32.exe	16
PID 2984 wrote to memory of 2092	2984	rundll32.exe	16
PID 2984 wrote to memory of 2092	2984	rundll32.exe	16
PID 2984 wrote to memory of 2092	2984	rundll32.exe	16
PID 2984 wrote to memory of 2092	2984	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\119c7e9307b2eda2e457ae0fc2d23b2c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\119c7e9307b2eda2e457ae0fc2d23b2c.dll,#1
  2⤵
  PID:2092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2092-0-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download
memory/2092-1-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download
memory/2092-2-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download