2e6d0446bcc9a86bf0bdfe91fac3160f48f2eff5ab595eb36db172eea072d6c4 | Triage

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04-02-2024 04:04

Sharing

Report Analysis Logs

General

Target

8e2c6a08fa7ed8e9ff93217d16f3cb42.dll
Size

65KB
MD5

8e2c6a08fa7ed8e9ff93217d16f3cb42
SHA1

8eca73f9eef5b6e5b1a8644b982b6bfee7dfc9ed
SHA256

2e6d0446bcc9a86bf0bdfe91fac3160f48f2eff5ab595eb36db172eea072d6c4
SHA512

d96b028bb31bef4e2fa35f1ff27e727a00d4e29cf05c9c9cdf65e856c72990cddcd454a6a19cd2ac5cb4e3d4ac53421deeb26a57b8416ae0712e45e43d0c81c3
SSDEEP

1536:yjJMzqRhEZLaWTfy5RXZR3fqP9JjA9U45UlVp:ObEJaWzy5RXZy9a9U5lVp

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2024-0-0x0000000010000000-0x0000000010663000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2024	2852	rundll32.exe	28
PID 2852 wrote to memory of 2024	2852	rundll32.exe	28
PID 2852 wrote to memory of 2024	2852	rundll32.exe	28
PID 2852 wrote to memory of 2024	2852	rundll32.exe	28
PID 2852 wrote to memory of 2024	2852	rundll32.exe	28
PID 2852 wrote to memory of 2024	2852	rundll32.exe	28
PID 2852 wrote to memory of 2024	2852	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8e2c6a08fa7ed8e9ff93217d16f3cb42.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8e2c6a08fa7ed8e9ff93217d16f3cb42.dll,#1
  2⤵
  PID:2024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2024-0-0x0000000010000000-0x0000000010663000-memory.dmp

Filesize
6.4MB

Download