22dff6dc4eeb9335cf11eb5972b19e57c22f24cfa766b6a1474ddbb831a1bb56

Analysis

max time kernel
147s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 20:27

Target

22dff6dc4eeb9335cf11eb5972b19e57c22f24cfa766b6a1474ddbb831a1bb56.exe
Size

1.5MB
MD5

ac46ef43a63cb88281f130d53158cbb4
SHA1

29add1513a379baf1a7f44bf999944a3296fcea7
SHA256

22dff6dc4eeb9335cf11eb5972b19e57c22f24cfa766b6a1474ddbb831a1bb56
SHA512

bbb61fee8eabede267948ce67f3410a23e39720d3e0bf2a078ac124ab4bc4230021fd425d1c5a902526f9c6dfffcd57197cf98ccb3defbdaba8a7ce100546fd2
SSDEEP

24576:R2ycZcUtlGValkPub+rQMQTZaqdiXSp0c02uFG6dAk374g3G3tM:RWZ0SpbLTZaqdwk0c05HGipIM

Score

9^/10

upx

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0006000000022e2e-132.dat	acprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/files/0x0006000000022e2e-132.dat	upx
behavioral2/memory/4724-133-0x0000000010000000-0x000000001003D000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
4724	22dff6dc4eeb9335cf11eb5972b19e57c22f24cfa766b6a1474ddbb831a1bb56.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
372	4724	WerFault.exe	79
4064	4724	WerFault.exe	79

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4724	22dff6dc4eeb9335cf11eb5972b19e57c22f24cfa766b6a1474ddbb831a1bb56.exe
4724	22dff6dc4eeb9335cf11eb5972b19e57c22f24cfa766b6a1474ddbb831a1bb56.exe
4724	22dff6dc4eeb9335cf11eb5972b19e57c22f24cfa766b6a1474ddbb831a1bb56.exe
4724	22dff6dc4eeb9335cf11eb5972b19e57c22f24cfa766b6a1474ddbb831a1bb56.exe
4724	22dff6dc4eeb9335cf11eb5972b19e57c22f24cfa766b6a1474ddbb831a1bb56.exe

C:\Users\Admin\AppData\Local\Temp\22dff6dc4eeb9335cf11eb5972b19e57c22f24cfa766b6a1474ddbb831a1bb56.exe
"C:\Users\Admin\AppData\Local\Temp\22dff6dc4eeb9335cf11eb5972b19e57c22f24cfa766b6a1474ddbb831a1bb56.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 952
  2⤵
  - Program crash
  PID:372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 972
  2⤵
  - Program crash
  PID:4064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4724 -ip 4724
1⤵
PID:1364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4724 -ip 4724
1⤵
PID:2572

C:\Users\Admin\AppData\Local\Temp\SkinH_EL.dll

Filesize
86KB

MD5
147127382e001f495d1842ee7a9e7912

SHA1
92d1ed56032183c75d4b57d7ce30b1c4ae11dc9b

SHA256
edf679c02ea2e170e67ab20dfc18558e2bfb4ee5d59eceeaea4b1ad1a626c3cc

SHA512
97f5ae90a1bbacfe39b9e0f2954c24f9896cc9dca9d14364c438862996f3bbc04a4aa515742fccb3679d222c1302f5bb40c7eaddd6b5859d2d6ef79490243a4d

Download Submit
memory/4724-133-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download