df795978119c8c94dea69611639b74dc9c08e7fb5871c3a664f9b2b26c85046c

Analysis

max time kernel
89s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 12:36

Target

df795978119c8c94dea69611639b74dc9c08e7fb5871c3a664f9b2b26c85046c.dll
Size

972KB
MD5

5ea9df73fc5421a424292a2a68bad357
SHA1

77de80c201ddf766d9ecc9242ef035dd8edf49ec
SHA256

df795978119c8c94dea69611639b74dc9c08e7fb5871c3a664f9b2b26c85046c
SHA512

4e2681db49a734e20a77e6c9c79a6a3aad49ede6acc78996ed35d91567941871bb19fb81a48cdd128bc8636dfe4d8a6ed47eea21c8316c93e1b4e15efec91903
SSDEEP

12288:AjugM3Wdv42e+G7XSMXADLJnaZ9AuTD6JBn7v2zeUcdBoSFXn1d:AEiwXnXcLxaZ9AunO7v2zeU631d

Score

9^/10

upx

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Windows\SysWOW64\SkinH_EL.dll	acprotect
C:\Windows\SysWOW64\SkinH_EL.dll	acprotect

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
C:\Windows\SysWOW64\SkinH_EL.dll	upx
C:\Windows\SysWOW64\SkinH_EL.dll	upx
behavioral2/memory/2976-135-0x0000000004430000-0x000000000446C000-memory.dmp	upx
behavioral2/memory/2976-136-0x0000000004430000-0x000000000446C000-memory.dmp	upx

Loads dropped DLL 2 IoCs

Processes:

rundll32.exe

pid process

2976 rundll32.exe
2976 rundll32.exe
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\SkinH_EL.dll rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\SkinH_EL.dll	rundll32.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3068 wrote to memory of 2976	3068	rundll32.exe	rundll32.exe
PID 3068 wrote to memory of 2976	3068	rundll32.exe	rundll32.exe
PID 3068 wrote to memory of 2976	3068	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\df795978119c8c94dea69611639b74dc9c08e7fb5871c3a664f9b2b26c85046c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3068

C:\Windows\SysWOW64\SkinH_EL.dll
Filesize
86KB

MD5
8e1ebf661ba3518d4afdf0516308a3ea

SHA1
e56f4de1402d4bdedb492c751cc363eb6e55c360

SHA256
d748b34b19f86aee6f94824eb3a0a1aa7fc0b003e7ad759d224f7b5a2fb870f2

SHA512
96d6744c2f6e5aaa96aa93347a2183092daf4971f74f2e19f29c5277d0d89593df0333ababd89fb32a934488fdb996dddd448a5e3e2270b1a66b793b38c897ec

Download Submit
C:\Windows\SysWOW64\SkinH_EL.dll
Filesize
86KB

MD5
8e1ebf661ba3518d4afdf0516308a3ea

SHA1
e56f4de1402d4bdedb492c751cc363eb6e55c360

SHA256
d748b34b19f86aee6f94824eb3a0a1aa7fc0b003e7ad759d224f7b5a2fb870f2

SHA512
96d6744c2f6e5aaa96aa93347a2183092daf4971f74f2e19f29c5277d0d89593df0333ababd89fb32a934488fdb996dddd448a5e3e2270b1a66b793b38c897ec

Download Submit
memory/2976-132-0x0000000000000000-mapping.dmp

Download
memory/2976-135-0x0000000004430000-0x000000000446C000-memory.dmp

Filesize
240KB

Download
memory/2976-136-0x0000000004430000-0x000000000446C000-memory.dmp

Filesize
240KB

Download