66c34ef6cd48d4b403149e09a1097c2d8a9f8934d92ed20e9507999ed46b3b62 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 16:35

Sharing

Report Analysis Logs

General

Target

74fb6cd02b6f2bd51170ba6fa97c6150.dll
Size

63KB
MD5

74fb6cd02b6f2bd51170ba6fa97c6150
SHA1

a52ed16a2cc62610799ae8e191fe15ceca89f680
SHA256

66c34ef6cd48d4b403149e09a1097c2d8a9f8934d92ed20e9507999ed46b3b62
SHA512

a1640e40f59b748c91fbcd7d8f9e8aa85a4e80da77ece47e4ab95f15649e84d5e837a707d29495afc0794cbe0e1163613cd13717d96043833dff68330aa41bdd
SSDEEP

1536:Bm1NGJVGLnVWumfvi+Kni1h62B75mSFN53ypbw:kX0VYafvixn+zmSF+pU

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2312-0-0x0000000010000000-0x0000000010013000-memory.dmp	upx
behavioral1/memory/2312-1-0x0000000010000000-0x0000000010013000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2312	2336	rundll32.exe	28
PID 2336 wrote to memory of 2312	2336	rundll32.exe	28
PID 2336 wrote to memory of 2312	2336	rundll32.exe	28
PID 2336 wrote to memory of 2312	2336	rundll32.exe	28
PID 2336 wrote to memory of 2312	2336	rundll32.exe	28
PID 2336 wrote to memory of 2312	2336	rundll32.exe	28
PID 2336 wrote to memory of 2312	2336	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74fb6cd02b6f2bd51170ba6fa97c6150.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\74fb6cd02b6f2bd51170ba6fa97c6150.dll,#1
  2⤵
  PID:2312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2312-0-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2312-1-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download