809eb0570ba5abcd4ab012b354b4e1f0311eff595b1988ab0735bf1ab846e632 | Triage

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 14:04

Sharing

Report Analysis Logs

General

Target

FunWorks.dll
Size

481KB
MD5

87c9936e5241d7fad0db1edee0b7415b
SHA1

33e9ec650610a39a7be73718af60515b830940e8
SHA256

9879ce05f338416a102fe9820f1d17a85df8b147f3ca3398e49bdc5856abb0ff
SHA512

2de678227a67807cd7b002de130327ee02a1f4843d065446a523acffa5cad79afd074e7344edc08d0def74735d4aa4d16b05af0e8b0b44c4b9f8cec157f9fa18
SSDEEP

12288:47UNkQGBCFuoXwLcVUPjuIC528CwohPiNd9CpDxxsnN:iBCXwLckuIS2dwoh6d8dxsN

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral29/memory/2792-0-0x0000000074E40000-0x0000000074F62000-memory.dmp	upx
behavioral29/memory/2792-1-0x0000000074D10000-0x0000000074E32000-memory.dmp	upx
behavioral29/memory/2792-3-0x0000000074D10000-0x0000000074E32000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2792	2108	rundll32.exe	28
PID 2108 wrote to memory of 2792	2108	rundll32.exe	28
PID 2108 wrote to memory of 2792	2108	rundll32.exe	28
PID 2108 wrote to memory of 2792	2108	rundll32.exe	28
PID 2108 wrote to memory of 2792	2108	rundll32.exe	28
PID 2108 wrote to memory of 2792	2108	rundll32.exe	28
PID 2108 wrote to memory of 2792	2108	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FunWorks.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\FunWorks.dll,#1
  2⤵
  PID:2792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2792-0-0x0000000074E40000-0x0000000074F62000-memory.dmp

Filesize
1.1MB

Download
memory/2792-2-0x0000000074E40000-0x0000000074F62000-memory.dmp

Filesize
1.1MB

Download
memory/2792-1-0x0000000074D10000-0x0000000074E32000-memory.dmp

Filesize
1.1MB

Download
memory/2792-3-0x0000000074D10000-0x0000000074E32000-memory.dmp

Filesize
1.1MB

Download