5bf39101edeab0d2e8df20961de3ca677814fcf234e250018b4a5471fdb47c85 | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 21:19

Sharing

Report Analysis Logs

General

Target

f8d7dc737a278e8fded29e305e6b8224.dll
Size

68KB
MD5

f8d7dc737a278e8fded29e305e6b8224
SHA1

b07681ba9568d88c43f062b8b549e8397cf7e974
SHA256

5bf39101edeab0d2e8df20961de3ca677814fcf234e250018b4a5471fdb47c85
SHA512

cdd2056468e327350abe76cda29dc6cbff986b207e2e7e404a5c2348423c46a3bba88f226d73deeddc0a61d612f50098b886f64a8e8771ce9a2d7241aa414bbc
SSDEEP

1536:Bm1NGJVGj0oB6E1AFDKyx27+w4jlm2sCriVVNU4Ms:kX0VCfmFDKysYjMHCrGos

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2168-0-0x0000000010000000-0x0000000010013000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2168	3056	rundll32.exe	29
PID 3056 wrote to memory of 2168	3056	rundll32.exe	29
PID 3056 wrote to memory of 2168	3056	rundll32.exe	29
PID 3056 wrote to memory of 2168	3056	rundll32.exe	29
PID 3056 wrote to memory of 2168	3056	rundll32.exe	29
PID 3056 wrote to memory of 2168	3056	rundll32.exe	29
PID 3056 wrote to memory of 2168	3056	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8d7dc737a278e8fded29e305e6b8224.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8d7dc737a278e8fded29e305e6b8224.dll,#1
  2⤵
  PID:2168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2168-0-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download