3e593c473ea647790c07e6d1ba5b8fee376a9170daaeb530cb234eacf13d70ac | Triage

Analysis

max time kernel
118s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 20:51

Sharing

Report Analysis Logs

General

Target

f7509f2aceb2c76bef5ad6bee49bde57.dll
Size

64KB
MD5

f7509f2aceb2c76bef5ad6bee49bde57
SHA1

6541b4680c5e49fe989ed2eccd2542f6657b0e7b
SHA256

3e593c473ea647790c07e6d1ba5b8fee376a9170daaeb530cb234eacf13d70ac
SHA512

2abb0b895966d3478def05ca67492432c6f63d4cbfa95b63067b23e97ebace2961a1bce85b7ac01c0b5fd051cd5a6c9ebde39dde92970e397575186c43564cef
SSDEEP

1536:yl3E0T8ixN1MpgAn64AVd8SWXnoHQ27dgSfOa9Q:E39QixNu9n64SWXsn7maS

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2472-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral1/memory/2472-1-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral1/memory/2472-2-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2472	2772	rundll32.exe	28
PID 2772 wrote to memory of 2472	2772	rundll32.exe	28
PID 2772 wrote to memory of 2472	2772	rundll32.exe	28
PID 2772 wrote to memory of 2472	2772	rundll32.exe	28
PID 2772 wrote to memory of 2472	2772	rundll32.exe	28
PID 2772 wrote to memory of 2472	2772	rundll32.exe	28
PID 2772 wrote to memory of 2472	2772	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7509f2aceb2c76bef5ad6bee49bde57.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7509f2aceb2c76bef5ad6bee49bde57.dll,#1
  2⤵
  PID:2472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2472-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2472-1-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2472-2-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2472-3-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download