e1d143958486dd57b59894eebdb67a238a0daff7290ead692761fef897ddd392 | Triage

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 03:51

Sharing

Report Analysis Logs

General

Target

03eb8a68f6e5f2fca41f1ca35b620d6e.dll
Size

416KB
MD5

03eb8a68f6e5f2fca41f1ca35b620d6e
SHA1

e787c020a30a0742cf065aa30ed7526104142e7f
SHA256

e1d143958486dd57b59894eebdb67a238a0daff7290ead692761fef897ddd392
SHA512

1589f94df31403bae13acf7da52c20f0452b860614b437f5785077a17d87a2a120268812dbe103059b3c68380c4b930d770d84ffebde71f07dea2cb323eeee38
SSDEEP

12288:ANTzjygbjyHwj/A7ifqi17W0CSU1kwA2+:ANr2Hh7irVgW/

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2328-0-0x0000000010000000-0x0000000010129000-memory.dmp	upx
behavioral1/memory/2328-1-0x0000000010000000-0x0000000010129000-memory.dmp	upx
behavioral1/memory/2328-3-0x0000000010000000-0x0000000010129000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2328	2284	rundll32.exe	28
PID 2284 wrote to memory of 2328	2284	rundll32.exe	28
PID 2284 wrote to memory of 2328	2284	rundll32.exe	28
PID 2284 wrote to memory of 2328	2284	rundll32.exe	28
PID 2284 wrote to memory of 2328	2284	rundll32.exe	28
PID 2284 wrote to memory of 2328	2284	rundll32.exe	28
PID 2284 wrote to memory of 2328	2284	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\03eb8a68f6e5f2fca41f1ca35b620d6e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\03eb8a68f6e5f2fca41f1ca35b620d6e.dll,#1
  2⤵
  PID:2328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2328-0-0x0000000010000000-0x0000000010129000-memory.dmp

Filesize
1.2MB

Download
memory/2328-1-0x0000000010000000-0x0000000010129000-memory.dmp

Filesize
1.2MB

Download
memory/2328-2-0x0000000010000000-0x0000000010129000-memory.dmp

Filesize
1.2MB

Download
memory/2328-3-0x0000000010000000-0x0000000010129000-memory.dmp

Filesize
1.2MB

Download