56c46d532f0c3e73c64d73cf15f89500d50e9142b8a91cf940432f2fb27d6065

Analysis

max time kernel
144s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 06:12

Target

三国魂战魂/主控台.exe
Size

2.7MB
MD5

bbaa354b0de6d6168e09a8a49b25bbf5
SHA1

b44422d49a992b8caff25dddfd0d8fdad56fc596
SHA256

e61a5b44008c8f4fd0d02b7ac6e8bcd055f0144fa8d253b20b602a89960a5557
SHA512

3dc4640c7da488996c64c426eeb8e9364404e3c78d31d445c8fddaa899394cb8a88ed74e1a9b1426f35defa2b58b729a56749e866d55acc64b08fa1a4445a7d7
SSDEEP

49152:LDGb1EspZ38TVtrLuNMQJ38YUtUwgwvP+3kX/KXpMZMP6Rja9hTFrgfE4kTsJNL6:CCZFjEofoIfN/dBAKaZ/pJrP

Score

9^/10

upx

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Windows\jedata.dll	acprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
C:\Windows\jedata.dll	upx
behavioral10/memory/376-137-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Loads dropped DLL 1 IoCs

Processes:

主控台.exe

pid process

376 主控台.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

主控台.exe

pid process

376 主控台.exe
376 主控台.exe
376 主控台.exe
Drops file in Windows directory 2 IoCs

Processes:

主控台.exe

description ioc process

File created C:\Windows\jedata.dll 主控台.exe
File created C:\Windows\win8.she 主控台.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4852 376 WerFault.exe 主控台.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

主控台.exe

pid process

376 主控台.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

主控台.exe

pid process

376 主控台.exe
376 主控台.exe
376 主控台.exe

pid	process
376	主控台.exe

description	ioc	process
File created	C:\Windows\jedata.dll	主控台.exe
File created	C:\Windows\win8.she	主控台.exe

pid	pid_target	process	target process
4852	376	WerFault.exe	主控台.exe

pid	process
376	主控台.exe

C:\Users\Admin\AppData\Local\Temp\三国魂战魂\主控台.exe
"C:\Users\Admin\AppData\Local\Temp\三国魂战魂\主控台.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:376
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 288
  2⤵
  - Program crash
  PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 376 -ip 376
1⤵
PID:1304

C:\Windows\jedata.dll

Filesize
86KB

MD5
114054313070472cd1a6d7d28f7c5002

SHA1
9a044986e6101df1a126035da7326a50c3fe9a23

SHA256
e15d9e1b772fed3db19e67b8d54533d1a2d46a37f8b12702a5892c6b886e9db1

SHA512
a2ff8481e89698dae4a1c83404105093472e384d7a3debbd7014e010543e08efc8ebb3f67c8a4ce09029e6b2a8fb7779bb402aae7c9987e61389cd8a72c73522

Download Submit
memory/376-132-0x0000000000400000-0x0000000000808000-memory.dmp

Filesize
4.0MB

Download
memory/376-133-0x0000000000400000-0x0000000000808000-memory.dmp

Filesize
4.0MB

Download
memory/376-134-0x0000000000400000-0x0000000000808000-memory.dmp

Filesize
4.0MB

Download
memory/376-135-0x0000000000890000-0x0000000000898000-memory.dmp

Filesize
32KB

Download
memory/376-137-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/376-138-0x0000000000400000-0x0000000000808000-memory.dmp

Filesize
4.0MB

Download