Analysis

  • max time kernel
    110s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03-01-2025 11:08

General

  • Target

    f70ddee3625a9916c0c9ae45752abd42d46076dcd948d2b9039dddcd81d8a478N.dll

  • Size

    76KB

  • MD5

    7fb244129e46ab9cdaee095e3ca67e80

  • SHA1

    0c594b8d07b5d0760474f2e5053f34f6fbafb408

  • SHA256

    f70ddee3625a9916c0c9ae45752abd42d46076dcd948d2b9039dddcd81d8a478

  • SHA512

    0c2657bdfeee26bf49d0f8eeb48c3c4a61c42a4ad9a70965874c052368641c8b1a176dbab5b42f4edf113b5cc90a3614bd179a45dc2f251ea96da690a1d008f1

  • SSDEEP

    1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZWjk:c8y93KQjy7G55riF1cMo038k

Score
5/10

Malware Config

Signatures

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\f70ddee3625a9916c0c9ae45752abd42d46076dcd948d2b9039dddcd81d8a478N.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2752
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\f70ddee3625a9916c0c9ae45752abd42d46076dcd948d2b9039dddcd81d8a478N.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2808

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2808-0-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/2808-2-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/2808-3-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/2808-1-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/2808-4-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/2808-5-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.