cdcacc06ebf66b3878d24a09ff64fac1b159c9ea8298c5923fd3618178b3af67

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 13:44

Target

ZinRead/alleg40.dll
Size

216KB
MD5

99f36c845c4fbc0ac02922e023a0defa
SHA1

8a9527cbf2e4f01f437c5c939ec9c6f277b322de
SHA256

935a30d6d0ffa7a8e75874a7ad689419ff6ead369a19c83b9dd4b372c1cf680e
SHA512

6d54476331f25994ffeb22dccfcd0ff49e70d7fccaf7c93e1069d5b4d09cbb540eefbc22e3111c3bd822caf7bc9c2ed80c989f9c0e5e6e27a0b6c8fc5e509f60
SSDEEP

3072:v/TNRUZL5gVWjLlHvi8OesL1sNHhnwlWTbTL3gvs4wGwBBm4Gel6bZ4GKl0hKGnV:XxRUZLVttIZIndzciBB8+g6n0

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral3/memory/2108-0-0x0000000010000000-0x00000000100B2000-memory.dmp	upx
behavioral3/memory/2108-1-0x0000000010000000-0x00000000100B2000-memory.dmp	upx
behavioral3/memory/2108-2-0x0000000010000000-0x00000000100B2000-memory.dmp	upx
behavioral3/memory/2108-3-0x0000000010000000-0x00000000100B2000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3048	2108	WerFault.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2108	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2108	2428	rundll32.exe	28
PID 2428 wrote to memory of 2108	2428	rundll32.exe	28
PID 2428 wrote to memory of 2108	2428	rundll32.exe	28
PID 2428 wrote to memory of 2108	2428	rundll32.exe	28
PID 2428 wrote to memory of 2108	2428	rundll32.exe	28
PID 2428 wrote to memory of 2108	2428	rundll32.exe	28
PID 2428 wrote to memory of 2108	2428	rundll32.exe	28
PID 2108 wrote to memory of 3048	2108	rundll32.exe	29
PID 2108 wrote to memory of 3048	2108	rundll32.exe	29
PID 2108 wrote to memory of 3048	2108	rundll32.exe	29
PID 2108 wrote to memory of 3048	2108	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZinRead\alleg40.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZinRead\alleg40.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 272
    3⤵
    - Program crash
    PID:3048

memory/2108-0-0x0000000010000000-0x00000000100B2000-memory.dmp

Filesize
712KB

Download
memory/2108-1-0x0000000010000000-0x00000000100B2000-memory.dmp

Filesize
712KB

Download
memory/2108-2-0x0000000010000000-0x00000000100B2000-memory.dmp

Filesize
712KB

Download
memory/2108-3-0x0000000010000000-0x00000000100B2000-memory.dmp

Filesize
712KB

Download