fa902dee67f4df6fea3268e9f97ef4c735cea8da4d333b03bfd9b972e993c15a

Analysis

max time kernel
17s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 10:53

Target

fa902dee67f4df6fea3268e9f97ef4c735cea8da4d333b03bfd9b972e993c15a.dll
Size

840KB
MD5

906f96e4c44c9e04109c06d3fa287614
SHA1

465261371d5de273edea191c6f2b7385bf034aab
SHA256

fa902dee67f4df6fea3268e9f97ef4c735cea8da4d333b03bfd9b972e993c15a
SHA512

d3c91ec7027257d5844bfc38d57070efd344073208c88db98f397a52634638b90c26c5e383083f31901469cc9fe64114e570f78adb656500a002a779a269915b
SSDEEP

12288:sPARC0v+8TPQtHHbD65qKVcKSKdA0xOeQWVOWOBrB:sPARC0v+QMiqMcKSKdASOaLm

Score

8^/10

evasion

Blocks application from running via registry modification 6 IoCs

Adds application to list of disallowed applications.

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "yylauncher.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "YY.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "e_patcher.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "e.exe"	rundll32.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
944	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 944	1728	rundll32.exe	28
PID 1728 wrote to memory of 944	1728	rundll32.exe	28
PID 1728 wrote to memory of 944	1728	rundll32.exe	28
PID 1728 wrote to memory of 944	1728	rundll32.exe	28
PID 1728 wrote to memory of 944	1728	rundll32.exe	28
PID 1728 wrote to memory of 944	1728	rundll32.exe	28
PID 1728 wrote to memory of 944	1728	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa902dee67f4df6fea3268e9f97ef4c735cea8da4d333b03bfd9b972e993c15a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa902dee67f4df6fea3268e9f97ef4c735cea8da4d333b03bfd9b972e993c15a.dll,#1
  2⤵
  - Blocks application from running via registry modification
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:944

memory/944-55-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download