Analysis

  • max time kernel
    140s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    29-03-2024 02:37

General

  • Target

    $PLUGINSDIR/SelfDel.dll

  • Size

    5KB

  • MD5

    ca8bcdded6b265453cf68bae8bbd0b3a

  • SHA1

    9dbe872ac53e075c0954c882d034aa009c733092

  • SHA256

    299ba97dda721cc9216bda218769eb269a239c8bcf09bd6acc774ff935849184

  • SHA512

    a9b19434c35236a049036f0153a5c7184c95249fdb04ef7605484551d40a8aba37462eb617e96301cd4363a324f0282e26179ce4b78973ca43e0a63b4dffb33c

  • SSDEEP

    48:S17Ql+sbsjAowLVEq1y58vzWLDjjZSeJY8JTaTIUNEyTFS7lr0zsBEaSujrt6EQD:v8sgYLVEX4zwjINxS7xg+TScrQD

Score
9/10
upx

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2644
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2460
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 220
        3⤵
        • Program crash
        PID:3040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2460-0-0x00000000753D0000-0x00000000753D9000-memory.dmp

    Filesize

    36KB

  • memory/2460-1-0x00000000753C0000-0x00000000753C9000-memory.dmp

    Filesize

    36KB

  • memory/2460-4-0x00000000753D0000-0x00000000753D9000-memory.dmp

    Filesize

    36KB

  • memory/2460-5-0x00000000753D0000-0x00000000753D9000-memory.dmp

    Filesize

    36KB