46d50a60519be7018ff2596532d29d16a9a926bc85e6c0f03cd16e77d18bb579 | Triage

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 03:33

Sharing

Report Analysis Logs

General

Target

PhotoDream_ha/appface.dll
Size

241KB
MD5

f9c75320e630180b0b1e6a99a1becfc6
SHA1

a99b4db04c203d729367604107a283517d187c0e
SHA256

54a4e158f1d8d086a21ebcff9c6c65f0df228cbd5b15642b648e3679687079ea
SHA512

99eac7190483f294079faca045eda96ebb03f37a1b44817b1800e55d29bd8efa473318c56174c08dfa825bf5633ae0cccd2b7cdbc3f61bfb65cfa9ec1a480b86
SSDEEP

6144:RAH2TxJdhqagEzOEwt7oKudfFUmArmfhfsUrKE2rq/vrIuUq:O2dIag8KpsS6NsjEWqHrNUq

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral5/memory/2128-0-0x0000000010000000-0x00000000100A7000-memory.dmp	upx
behavioral5/memory/2128-2-0x0000000010000000-0x00000000100A7000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2128	1704	rundll32.exe	16
PID 1704 wrote to memory of 2128	1704	rundll32.exe	16
PID 1704 wrote to memory of 2128	1704	rundll32.exe	16
PID 1704 wrote to memory of 2128	1704	rundll32.exe	16
PID 1704 wrote to memory of 2128	1704	rundll32.exe	16
PID 1704 wrote to memory of 2128	1704	rundll32.exe	16
PID 1704 wrote to memory of 2128	1704	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PhotoDream_ha\appface.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PhotoDream_ha\appface.dll,#1
  2⤵
  PID:2128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2128-0-0x0000000010000000-0x00000000100A7000-memory.dmp

Filesize
668KB

Download
memory/2128-1-0x0000000010000000-0x00000000100A7000-memory.dmp

Filesize
668KB

Download
memory/2128-2-0x0000000010000000-0x00000000100A7000-memory.dmp

Filesize
668KB

Download