0558fb1ceb03dc50b23593f6b41f0352d1cce54954bd1fc1ad111be989f2ebd4 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 14:41

Sharing

Report Analysis Logs

General

Target

cbac9b7a45896f7b648bf3950ac3c4ab.dll
Size

29KB
MD5

cbac9b7a45896f7b648bf3950ac3c4ab
SHA1

91aa579bae35c2078d29e4793c5f84cfcca7c583
SHA256

0558fb1ceb03dc50b23593f6b41f0352d1cce54954bd1fc1ad111be989f2ebd4
SHA512

3888a340a4f156f7a024c00c57024e837aa41c42910a29056beb0dd16f552da0b560685fbcb6259b2b5302c8f4d7d916bc3da6045455887fb6fabcedc2e3a982
SSDEEP

768:gBaLxv5KPsZuHof2RrMGB1Wh0NAQh2hHz32zzsMASZcVU:GaCPo+WSnwhT36ASeU

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1592-0-0x0000000010000000-0x0000000010015000-memory.dmp	upx
behavioral1/memory/1592-1-0x0000000010000000-0x0000000010015000-memory.dmp	upx
behavioral1/memory/1592-2-0x0000000010000000-0x0000000010015000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 1592	1540	rundll32.exe	28
PID 1540 wrote to memory of 1592	1540	rundll32.exe	28
PID 1540 wrote to memory of 1592	1540	rundll32.exe	28
PID 1540 wrote to memory of 1592	1540	rundll32.exe	28
PID 1540 wrote to memory of 1592	1540	rundll32.exe	28
PID 1540 wrote to memory of 1592	1540	rundll32.exe	28
PID 1540 wrote to memory of 1592	1540	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbac9b7a45896f7b648bf3950ac3c4ab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbac9b7a45896f7b648bf3950ac3c4ab.dll,#1
  2⤵
  PID:1592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1592-0-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/1592-1-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/1592-2-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download