cdcacc06ebf66b3878d24a09ff64fac1b159c9ea8298c5923fd3618178b3af67

Analysis

max time kernel
169s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2023 13:44

Target

ZinRead/alleg40.dll
Size

216KB
MD5

99f36c845c4fbc0ac02922e023a0defa
SHA1

8a9527cbf2e4f01f437c5c939ec9c6f277b322de
SHA256

935a30d6d0ffa7a8e75874a7ad689419ff6ead369a19c83b9dd4b372c1cf680e
SHA512

6d54476331f25994ffeb22dccfcd0ff49e70d7fccaf7c93e1069d5b4d09cbb540eefbc22e3111c3bd822caf7bc9c2ed80c989f9c0e5e6e27a0b6c8fc5e509f60
SSDEEP

3072:v/TNRUZL5gVWjLlHvi8OesL1sNHhnwlWTbTL3gvs4wGwBBm4Gel6bZ4GKl0hKGnV:XxRUZLVttIZIndzciBB8+g6n0

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral4/memory/4844-0-0x0000000010000000-0x00000000100B2000-memory.dmp	upx
behavioral4/memory/4844-1-0x0000000010000000-0x00000000100B2000-memory.dmp	upx
behavioral4/memory/4844-2-0x0000000010000000-0x00000000100B2000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3976	4844	WerFault.exe	88
4000	4844	WerFault.exe	88

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4844	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 4844	2716	rundll32.exe	88
PID 2716 wrote to memory of 4844	2716	rundll32.exe	88
PID 2716 wrote to memory of 4844	2716	rundll32.exe	88
PID 4844 wrote to memory of 3976	4844	rundll32.exe	94
PID 4844 wrote to memory of 3976	4844	rundll32.exe	94
PID 4844 wrote to memory of 3976	4844	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZinRead\alleg40.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZinRead\alleg40.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 892
    3⤵
    - Program crash
    PID:3976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 892
    3⤵
    - Program crash
    PID:4000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4844 -ip 4844
1⤵
PID:4036

memory/4844-0-0x0000000010000000-0x00000000100B2000-memory.dmp

Filesize
712KB

Download
memory/4844-1-0x0000000010000000-0x00000000100B2000-memory.dmp

Filesize
712KB

Download
memory/4844-2-0x0000000010000000-0x00000000100B2000-memory.dmp

Filesize
712KB

Download