ec4874f6928981fb38d3decf932502bf2c40f21bdbbb0b293375df1925f38715 | Triage

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 09:41

Sharing

Report Analysis Logs

General

Target

dedacd8fba2a45f74dcf98b49f51fb50.dll
Size

13KB
MD5

dedacd8fba2a45f74dcf98b49f51fb50
SHA1

1147116c8ca65df9d51702a48636b6811bc42ee7
SHA256

ec4874f6928981fb38d3decf932502bf2c40f21bdbbb0b293375df1925f38715
SHA512

417b4b647957a4ff2752d43ddbb8673de26abf8fc34b104e4567935ef302bd87330c9fd2252f5c0173a3b8e4a375efa317659b3c3e59bd31767bf60ba50c7d4d
SSDEEP

384:1pHc/RC+wkR6WgIwahBBBprIa4FKnmfM46htWx:jkw+lwWHbr4FK946ht6

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1832-0-0x0000000038000000-0x000000003800D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 1832	2192	rundll32.exe	28
PID 2192 wrote to memory of 1832	2192	rundll32.exe	28
PID 2192 wrote to memory of 1832	2192	rundll32.exe	28
PID 2192 wrote to memory of 1832	2192	rundll32.exe	28
PID 2192 wrote to memory of 1832	2192	rundll32.exe	28
PID 2192 wrote to memory of 1832	2192	rundll32.exe	28
PID 2192 wrote to memory of 1832	2192	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dedacd8fba2a45f74dcf98b49f51fb50.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dedacd8fba2a45f74dcf98b49f51fb50.dll,#1
  2⤵
  PID:1832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1832-0-0x0000000038000000-0x000000003800D000-memory.dmp

Filesize
52KB

Download