7f0b4765e11cc5dbec65373291e2111ec797faeb84a36a3d0554ad7ec523f157 | Triage

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 00:56

Sharing

Report Analysis Logs

General

Target

95d36cd441b87ae4fe1958e2dd472e64.dll
Size

40KB
MD5

95d36cd441b87ae4fe1958e2dd472e64
SHA1

3d9de7921d25a4bd954f921aff61ee3a990c0113
SHA256

7f0b4765e11cc5dbec65373291e2111ec797faeb84a36a3d0554ad7ec523f157
SHA512

505ba453e47efe70657b7aac3687659ac75eb07c13af568ae3a82c7271d2e6a4962fa7f26ecea65a8a99553123cd30c299180065e89e887ceb972bf62e5db14b
SSDEEP

768:+tmU6BAsjumV9SDFieC4i3TdkjVDsWfeuvcLLzgI:Am3BVGEeCN3TdkjZs11L/5

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2448-0-0x0000000010000000-0x000000001001E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2448	3032	rundll32.exe	28
PID 3032 wrote to memory of 2448	3032	rundll32.exe	28
PID 3032 wrote to memory of 2448	3032	rundll32.exe	28
PID 3032 wrote to memory of 2448	3032	rundll32.exe	28
PID 3032 wrote to memory of 2448	3032	rundll32.exe	28
PID 3032 wrote to memory of 2448	3032	rundll32.exe	28
PID 3032 wrote to memory of 2448	3032	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\95d36cd441b87ae4fe1958e2dd472e64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\95d36cd441b87ae4fe1958e2dd472e64.dll,#1
  2⤵
  PID:2448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2448-0-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download