d9718394c6c28e85ea09bc6a328dd7b1d9a9171072ae9ac059e519d71e1d4492

Analysis

max time kernel
144s
max time network
388s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 15:46

Target

DNF绝情阁模型工具/SkinH_EL.dll
Size

86KB
MD5

8e1ebf661ba3518d4afdf0516308a3ea
SHA1

e56f4de1402d4bdedb492c751cc363eb6e55c360
SHA256

d748b34b19f86aee6f94824eb3a0a1aa7fc0b003e7ad759d224f7b5a2fb870f2
SHA512

96d6744c2f6e5aaa96aa93347a2183092daf4971f74f2e19f29c5277d0d89593df0333ababd89fb32a934488fdb996dddd448a5e3e2270b1a66b793b38c897ec
SSDEEP

1536:eEQMKJNkvpcVcaeLKDbu9l4R2MjHWig0horod35D7lvZZWHmyVClI30QJdrYSXnj:qTNkvp4cgvI4Rpj2+horwNlIUCPJdrpT

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral4/memory/2536-133-0x0000000010000000-0x000000001003C000-memory.dmp	upx

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1488 2536 WerFault.exe rundll32.exe
3600 2536 WerFault.exe rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

2536 rundll32.exe

pid	pid_target	process	target process
1488	2536	WerFault.exe	rundll32.exe
3600	2536	WerFault.exe	rundll32.exe

pid	process
2536	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4820 wrote to memory of 2536	4820	rundll32.exe	rundll32.exe
PID 4820 wrote to memory of 2536	4820	rundll32.exe	rundll32.exe
PID 4820 wrote to memory of 2536	4820	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DNF绝情阁模型工具\SkinH_EL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4820

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DNF绝情阁模型工具\SkinH_EL.dll,#1
2⤵
- Suspicious use of SetWindowsHookEx
PID:2536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 616
3⤵
- Program crash
PID:1488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 624
3⤵
- Program crash
PID:3600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2536 -ip 2536
1⤵
PID:2624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2536 -ip 2536
1⤵
PID:3336

memory/2536-132-0x0000000000000000-mapping.dmp

Download
memory/2536-133-0x0000000010000000-0x000000001003C000-memory.dmp

Filesize
240KB

Download