30cc21729caca66c9d9850e28ee42f7763e13f038fdba694ec379de1193fffc5 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 16:09

Sharing

Report Analysis Logs

General

Target

74f000839ab0a73a824ebd0afce260d8.dll
Size

56KB
MD5

74f000839ab0a73a824ebd0afce260d8
SHA1

f505d9b8d67752c1906c748d2127de0bf0f5a936
SHA256

30cc21729caca66c9d9850e28ee42f7763e13f038fdba694ec379de1193fffc5
SHA512

7ff5bfd1f3be1a56dbb59ec6ac6ab42cd7c0041c320fd66d7e611e27a1a769e220833662ce0d241e82674f9ba7c4a80241dbff999d1f94f467c5ed312f75eb48
SSDEEP

1536:Bm1NGJVG8CGPNTFczGTbTHANiC/uPOW+nznJ:kX0VNT6zGTbTmfLZnznJ

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1960-0-0x0000000010000000-0x0000000010013000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2440 wrote to memory of 1960	2440	rundll32.exe	rundll32.exe
PID 2440 wrote to memory of 1960	2440	rundll32.exe	rundll32.exe
PID 2440 wrote to memory of 1960	2440	rundll32.exe	rundll32.exe
PID 2440 wrote to memory of 1960	2440	rundll32.exe	rundll32.exe
PID 2440 wrote to memory of 1960	2440	rundll32.exe	rundll32.exe
PID 2440 wrote to memory of 1960	2440	rundll32.exe	rundll32.exe
PID 2440 wrote to memory of 1960	2440	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74f000839ab0a73a824ebd0afce260d8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2440

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74f000839ab0a73a824ebd0afce260d8.dll,#1
2⤵
PID:1960

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1960-0-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1960-1-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1960-2-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download