d002e32786e0f12a9ce1d4c68177f6bec961199b241bd10fcd96a3ae930fb0c1 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12-03-2024 16:40

Sharing

Report Analysis Logs

General

Target

c3d80184cf157ed587eeb4ce91a43844.dll
Size

54KB
MD5

c3d80184cf157ed587eeb4ce91a43844
SHA1

93a9a120fe791781eebcc9a85142ff4600fb77b4
SHA256

d002e32786e0f12a9ce1d4c68177f6bec961199b241bd10fcd96a3ae930fb0c1
SHA512

10ebcbc6e131832cf8ab33047153114df03a61cb9401e285609a85d10ddf9ee8b8e3ea83335aeb28f1c74b692e41408e9f2f1b9185e521a24ac87bd02ff6d533
SSDEEP

1536:CjAO15+cvdLVsI/aUbY7wz7mog8kvivMpVwg4b:CjAO+cvdJsyPT7dwTVwgY

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2044-0-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2044	2180	rundll32.exe	28
PID 2180 wrote to memory of 2044	2180	rundll32.exe	28
PID 2180 wrote to memory of 2044	2180	rundll32.exe	28
PID 2180 wrote to memory of 2044	2180	rundll32.exe	28
PID 2180 wrote to memory of 2044	2180	rundll32.exe	28
PID 2180 wrote to memory of 2044	2180	rundll32.exe	28
PID 2180 wrote to memory of 2044	2180	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c3d80184cf157ed587eeb4ce91a43844.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c3d80184cf157ed587eeb4ce91a43844.dll,#1
  2⤵
  PID:2044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2044-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download