07927575828630dbdd2066150d28a62afac32834d55163e55cd4e87ad50544d7 | Triage

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
06/06/2024, 00:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

msimg32.dll
Size

65KB
MD5

0b9fa0a5c24849660fac36fd430e7870
SHA1

888175763efceb30aaa2b809409b6f86f2d887a9
SHA256

0e0dc0b68f3ffa51efc7fef1d264b75a1ca2d8e28fb68249a0a14d84bbb350d4
SHA512

b00996c0e4d9ca0726794d5e8a3d7988948cf4ea7be43bb6fd77a0443b68cab776262107ce89545d9f381995a0aa0e5ed5a7cabdfd639eeb580667c758c2fb45
SSDEEP

1536:vjRlaYQZYvqdQHKDCg4kgQ20YX54jwPszuC87+h6mv:vjq1ZYvqQqDJ4kgQeXSms6CFP

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral5/memory/2420-0-0x0000000010000000-0x000000001001D000-memory.dmp	upx
behavioral5/memory/2420-3-0x0000000010000000-0x000000001001D000-memory.dmp	upx
behavioral5/memory/2420-2-0x0000000010000000-0x000000001001D000-memory.dmp	upx
behavioral5/memory/2420-1-0x0000000010000000-0x000000001001D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2420	2316	rundll32.exe	28
PID 2316 wrote to memory of 2420	2316	rundll32.exe	28
PID 2316 wrote to memory of 2420	2316	rundll32.exe	28
PID 2316 wrote to memory of 2420	2316	rundll32.exe	28
PID 2316 wrote to memory of 2420	2316	rundll32.exe	28
PID 2316 wrote to memory of 2420	2316	rundll32.exe	28
PID 2316 wrote to memory of 2420	2316	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\msimg32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\msimg32.dll,#1
  2⤵
  PID:2420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2420-0-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/2420-3-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/2420-2-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/2420-1-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download