1296fca72509b6a6cfb1fcf0371c853607ac4e4b8ee6fc25b36f0b2eb0a8853c

Analysis

max time kernel
55s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 23:34

Target

鑫财手机协议全能王/91vpn/appface.dll
Size

277KB
MD5

ca69f84b164dd69a96bef1b2761c7596
SHA1

81f352575d8056a8516b9cbb4f73b8c0c6730c28
SHA256

e6870e771feb8095b42f03349032cc08ca01948b6672ad307f7355232970e895
SHA512

f9ffc2ae28cb596f4c010ed860275c2ee2bdf96ac34ee2dd3b20bcf1c636d1f760ece74946c10eb41a031b61882a7eceaeac8b70e6a1d8ca03b02ebcaa38f857
SSDEEP

6144:FTa+ar8WYs/v9tS08ttqgGEp2zL6UQHNWgb5sZN4rZ2BYejlNTqFg91k:FaDxlx8hngH6UQH3CZNkI3O

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral3/memory/2044-56-0x0000000010000000-0x00000000100BC000-memory.dmp	upx
behavioral3/memory/2044-57-0x0000000010000000-0x00000000100BC000-memory.dmp	upx
behavioral3/memory/2044-58-0x0000000010000000-0x00000000100BC000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 1292 wrote to memory of 2044	1292	rundll32.exe	28
PID 1292 wrote to memory of 2044	1292	rundll32.exe	28
PID 1292 wrote to memory of 2044	1292	rundll32.exe	28
PID 1292 wrote to memory of 2044	1292	rundll32.exe	28
PID 1292 wrote to memory of 2044	1292	rundll32.exe	28
PID 1292 wrote to memory of 2044	1292	rundll32.exe	28
PID 1292 wrote to memory of 2044	1292	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\鑫财手机协议全能王\91vpn\appface.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\鑫财手机协议全能王\91vpn\appface.dll,#1
  2⤵
  PID:2044

memory/2044-54-0x0000000000000000-mapping.dmp

Download
memory/2044-55-0x0000000075531000-0x0000000075533000-memory.dmp

Filesize
8KB

Download
memory/2044-56-0x0000000010000000-0x00000000100BC000-memory.dmp

Filesize
752KB

Download
memory/2044-57-0x0000000010000000-0x00000000100BC000-memory.dmp

Filesize
752KB

Download
memory/2044-58-0x0000000010000000-0x00000000100BC000-memory.dmp

Filesize
752KB

Download