1717bb76bce63bd34f4ee9eb5449b510e9b787b7d5ce5edfcfe7f81bd00c6fec

Analysis

max time kernel
42s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 16:39

Target

加键盘记录dll/加键盘记录dll/VIPDll.dll
Size

119KB
MD5

875844cd39acbba37ec4b8a2ab63ef5a
SHA1

b89fa888f2459a6c621e59b1814605d8de5e7265
SHA256

044d4b93010ae485afed580339cd184d38c093e27ab4e29af9f563c853286b1a
SHA512

bd4e9337fb2fa17f0c12d356e16d8d658d8a81765af9cdbdb3c001ae055189d31dcb26e72dacfb5b988023861afe609e6ff4fc08f2b910252f7a41785dc62acb
SSDEEP

1536:+SFTXOm/CyKFNHcz9qSutBdyvGCEH9eF0LBLxbKZ+:+S9X7FKPHcRUtBwvGCEFFxbKZ+

Score

5^/10

Drops file in System32 directory 4 IoCs

Processes:

rundll32.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\.000	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\dllcache\.tmp	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\.tmp	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\dllcache\.000	rundll32.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1508 1380 WerFault.exe rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

rundll32.exe

description pid process

Token: SeRestorePrivilege 1380 rundll32.exe

pid	pid_target	process	target process
1508	1380	WerFault.exe	rundll32.exe

description	pid	process
Token: SeRestorePrivilege	1380	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1252 wrote to memory of 1380	1252	rundll32.exe	rundll32.exe
PID 1252 wrote to memory of 1380	1252	rundll32.exe	rundll32.exe
PID 1252 wrote to memory of 1380	1252	rundll32.exe	rundll32.exe
PID 1252 wrote to memory of 1380	1252	rundll32.exe	rundll32.exe
PID 1252 wrote to memory of 1380	1252	rundll32.exe	rundll32.exe
PID 1252 wrote to memory of 1380	1252	rundll32.exe	rundll32.exe
PID 1252 wrote to memory of 1380	1252	rundll32.exe	rundll32.exe
PID 1380 wrote to memory of 1508	1380	rundll32.exe	WerFault.exe
PID 1380 wrote to memory of 1508	1380	rundll32.exe	WerFault.exe
PID 1380 wrote to memory of 1508	1380	rundll32.exe	WerFault.exe
PID 1380 wrote to memory of 1508	1380	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\加键盘记录dll\加键盘记录dll\VIPDll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\加键盘记录dll\加键盘记录dll\VIPDll.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 376
    3⤵
    - Program crash
    PID:1508

memory/1380-54-0x0000000000000000-mapping.dmp

Download
memory/1380-55-0x0000000075611000-0x0000000075613000-memory.dmp

Filesize
8KB

Download
memory/1380-56-0x0000000001C20000-0x0000000001F46000-memory.dmp

Filesize
3.1MB

Download
memory/1508-57-0x0000000000000000-mapping.dmp

Download