Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03-01-2025 11:23

General

  • Target

    3c8b7a895122c08f5f835f066f7709e0583412ac22e6e67b749ec9f796c122a4N.dll

  • Size

    76KB

  • MD5

    95caf79aa734af95d8c7e01f3551ab30

  • SHA1

    73b4e8a1c668daf9b4a216a810d0a732e58f628e

  • SHA256

    3c8b7a895122c08f5f835f066f7709e0583412ac22e6e67b749ec9f796c122a4

  • SHA512

    67623b13089b3977001dadfb7b03a160fec4e5f6c9112e1b8520d2a6a2f73e142c8df43665525d6ceec010cd138918e96cc0d06c7df9fd40bfff3e316d1232ba

  • SSDEEP

    1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7Z08OoVIP:c8y93KQjy7G55riF1cMo03Spoy

Score
5/10

Malware Config

Signatures

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c8b7a895122c08f5f835f066f7709e0583412ac22e6e67b749ec9f796c122a4N.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1524
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c8b7a895122c08f5f835f066f7709e0583412ac22e6e67b749ec9f796c122a4N.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2136

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2136-2-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/2136-1-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/2136-0-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/2136-3-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/2136-4-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/2136-5-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.