Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    09/10/2024, 03:54

General

  • Target

    MCI_CMD.dll

  • Size

    9KB

  • MD5

    749343e1749c1b37128c62d2d9b431b8

  • SHA1

    56d4e9bf558b4bfa2ce9aefcff1c02fa9f0b3188

  • SHA256

    4eda148fa29b4f34740288c1b11a6ef5818a031b4049cc0e5fbadbb49025e0b3

  • SHA512

    1214c7849b299dbf113f0cabfdd12359b38859601a4045b4737db70d4e4f87b7da61f944244df2115c491a505990f3cdeb0bb48798d6799ec2259297d2271fb3

  • SSDEEP

    192:zdy78FRZPCdDJC3KpL2+DI/2k7mMn80Nb/cZq2UNSIv:zsAFeyzqI/2k6W7bj2UIu

Score
5/10

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\MCI_CMD.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:784
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\MCI_CMD.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2944

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2944-0-0x0000000010000000-0x000000001000B000-memory.dmp

    Filesize

    44KB

  • memory/2944-3-0x0000000010000000-0x000000001000B000-memory.dmp

    Filesize

    44KB

  • memory/2944-2-0x0000000010000000-0x000000001000B000-memory.dmp

    Filesize

    44KB

  • memory/2944-1-0x0000000010000000-0x000000001000B000-memory.dmp

    Filesize

    44KB