125ead9b9bc504f6183df5313731b3b7febc253a348706d4195392ea73bf0621

Analysis

max time kernel
151s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 04:51

Target

޸_繤�.exe
Size

1.5MB
MD5

76542d732bbe5889dc30cbdb74fed26c
SHA1

fe2ee61eb11c8bfdd4a3d8f86a11749b7a56fd37
SHA256

7cdf496782d371ef02f73e7fc5a8c2857d7789af7decc81e865a832767a27f92
SHA512

748956f9ed30a415e5cb273524d1ef6535a943a315bef8921b1da56e5ae0a6ed0468297b3722bafbff9b4f3f30c1f536c55558fb8f78eaf5003ed6b6c16b2407
SSDEEP

24576:1Oa97ONFo2t5YEOjAsQ6gkJeDZVcUVCyzgM1uH+i0NTlO8tHkq/bq+wD:1OaCoCROW3R6yzPuH+iQTl7tEqcD

Score

9^/10

upx

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\SkinH_EL.dll	acprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\SkinH_EL.dll	upx
behavioral4/memory/1076-134-0x0000000010000000-0x000000001003D000-memory.dmp	upx

Loads dropped DLL 1 IoCs

Processes:

޸_繤�.exe

pid process

1076 ޸_繤�.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
2884	1076	WerFault.exe	޸_繤�.exe
5032	1076	WerFault.exe	޸_繤�.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

޸_繤�.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1076 -s 1468
2⤵
- Program crash
PID:2884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1076 -s 1468
2⤵
- Program crash
PID:5032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1076 -ip 1076
1⤵
PID:1480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1076 -ip 1076
1⤵
PID:4888

C:\Users\Admin\AppData\Local\Temp\SkinH_EL.dll
Filesize
86KB

MD5
147127382e001f495d1842ee7a9e7912

SHA1
92d1ed56032183c75d4b57d7ce30b1c4ae11dc9b

SHA256
edf679c02ea2e170e67ab20dfc18558e2bfb4ee5d59eceeaea4b1ad1a626c3cc

SHA512
97f5ae90a1bbacfe39b9e0f2954c24f9896cc9dca9d14364c438862996f3bbc04a4aa515742fccb3679d222c1302f5bb40c7eaddd6b5859d2d6ef79490243a4d

Download Submit
memory/1076-132-0x0000000000400000-0x000000000066B200-memory.dmp

Filesize
2.4MB

Download
memory/1076-134-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1076-135-0x0000000000400000-0x000000000066B200-memory.dmp

Filesize
2.4MB

Download