ffe2a83d37b7b5657de5c2c2d3fc3db3f4703a0b1a19a9964226eba696040b09

Analysis

max time kernel
152s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 18:02

Target

1433_hack44.cn/NB12-18/SkinH.dll
Size

668KB
MD5

e8409d674111dff5cd94f0deebddc20b
SHA1

97c413f4154a01ef6fe19154ea677ea90097ef32
SHA256

9c15c24cea93b4c9830039d147203bb4ea0a19ac67248860e86d54e76d59b3d8
SHA512

8695870bafc701292fa13786449ac2afc738f6b791d0c26b5013d0984a62a31dd4440ed0896a639d6c1f853973f7f0dd1fed5df47fd718b12e2c0aaf6c9dd404
SSDEEP

12288:O4I+LDa4ekPTXYUZWtZaf9iDvK/5N9e4IRPpb5yxGO6hg6A5e3:OuDJVTXYUYtEVimng4IRPpw9je

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral23/memory/1528-60-0x0000000000370000-0x00000000003AD000-memory.dmp	upx
behavioral23/memory/1528-63-0x0000000000370000-0x00000000003AD000-memory.dmp	upx
behavioral23/memory/1528-62-0x0000000000370000-0x00000000003AD000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

rundll32.exe

pid process

1528 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1228 1528 WerFault.exe rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1528 rundll32.exe

pid	process
1528	rundll32.exe

pid	pid_target	process	target process
1228	1528	WerFault.exe	rundll32.exe

pid	process
1528	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1652 wrote to memory of 1528	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1528	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1528	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1528	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1528	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1528	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1528	1652	rundll32.exe	rundll32.exe
PID 1528 wrote to memory of 1228	1528	rundll32.exe	WerFault.exe
PID 1528 wrote to memory of 1228	1528	rundll32.exe	WerFault.exe
PID 1528 wrote to memory of 1228	1528	rundll32.exe	WerFault.exe
PID 1528 wrote to memory of 1228	1528	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1433_hack44.cn\NB12-18\SkinH.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1433_hack44.cn\NB12-18\SkinH.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 240
    3⤵
    - Program crash
    PID:1228

memory/1228-66-0x0000000000000000-mapping.dmp

Download
memory/1528-54-0x0000000000000000-mapping.dmp

Download
memory/1528-55-0x00000000753D1000-0x00000000753D3000-memory.dmp

Filesize
8KB

Download
memory/1528-56-0x0000000010000000-0x00000000101A3000-memory.dmp

Filesize
1.6MB

Download
memory/1528-60-0x0000000000370000-0x00000000003AD000-memory.dmp

Filesize
244KB

Download
memory/1528-63-0x0000000000370000-0x00000000003AD000-memory.dmp

Filesize
244KB

Download
memory/1528-62-0x0000000000370000-0x00000000003AD000-memory.dmp

Filesize
244KB

Download
memory/1528-64-0x0000000010000000-0x00000000101A3000-memory.dmp

Filesize
1.6MB

Download
memory/1528-65-0x0000000010000000-0x00000000101A3000-memory.dmp

Filesize
1.6MB

Download