c7abdc5c18a0a75619b1b6f931223e019a116bd0489950a328e53411258d3072 | Triage

Analysis

max time kernel
2s
max time network
5s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-03-2024 07:10

Sharing

Report Analysis Logs

General

Target

bad4e2e7504f8534458a9d9dd7b1362f.dll
Size

15KB
MD5

bad4e2e7504f8534458a9d9dd7b1362f
SHA1

1dd40be8446808cc50ac38ff2f82fb0deed19b44
SHA256

c7abdc5c18a0a75619b1b6f931223e019a116bd0489950a328e53411258d3072
SHA512

d8c8f88548b7d17b5560877e2f426d6c762ed94edd99d750767c78ae7391468dcbc73810fc168f77ed8be5290dc0c2213882ddec364b9839b896366d8d9e4418
SSDEEP

384:SDO9CQ5s90+e+rSzHbdO9bZ5KECRmpAPnWIT:ahU5mlMECQCPnfT

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1216-0-0x0000000074E40000-0x0000000074E4E000-memory.dmp	upx
behavioral1/memory/1216-2-0x0000000074E40000-0x0000000074E4E000-memory.dmp	upx
behavioral1/memory/1216-1-0x0000000074E40000-0x0000000074E4E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 1216	1408	rundll32.exe	28
PID 1408 wrote to memory of 1216	1408	rundll32.exe	28
PID 1408 wrote to memory of 1216	1408	rundll32.exe	28
PID 1408 wrote to memory of 1216	1408	rundll32.exe	28
PID 1408 wrote to memory of 1216	1408	rundll32.exe	28
PID 1408 wrote to memory of 1216	1408	rundll32.exe	28
PID 1408 wrote to memory of 1216	1408	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bad4e2e7504f8534458a9d9dd7b1362f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bad4e2e7504f8534458a9d9dd7b1362f.dll,#1
  2⤵
  PID:1216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1216-0-0x0000000074E40000-0x0000000074E4E000-memory.dmp

Filesize
56KB

Download
memory/1216-2-0x0000000074E40000-0x0000000074E4E000-memory.dmp

Filesize
56KB

Download
memory/1216-1-0x0000000074E40000-0x0000000074E4E000-memory.dmp

Filesize
56KB

Download