4216f6459fd0275a0c20b6ba45236cfb22f7f328f42b869203ac389bbec3fbd2

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
13/11/2023, 16:56

Target

4216f6459fd0275a0c20b6ba45236cfb22f7f328f42b869203ac389bbec3fbd2.dll
Size

5.0MB
MD5

854ea636a4c56d84025e9d46560e29e5
SHA1

1de2ed653e036dd0cf4aa03d75ea31228f879ade
SHA256

4216f6459fd0275a0c20b6ba45236cfb22f7f328f42b869203ac389bbec3fbd2
SHA512

e60cf559ac14e0454d9995c938a3d1d0b4670144f19b7303d37bad0606a64b9099c8779d1db6c05652cf12705563e7f595f0ca2d22c758b38f6136146ca2a6d5
SSDEEP

98304:4LoSYcJBAUZL26T6F9628sPyYFivvKncMpzJOP:mBJVq6z28whivV

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2900	rundll32.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2900-5-0x00000000001F0000-0x00000000001FB000-memory.dmp	upx
behavioral1/memory/2900-4-0x00000000001F0000-0x00000000001FB000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2640	2900	WerFault.exe	17

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2900	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2900	2848	rundll32.exe	17
PID 2848 wrote to memory of 2900	2848	rundll32.exe	17
PID 2848 wrote to memory of 2900	2848	rundll32.exe	17
PID 2848 wrote to memory of 2900	2848	rundll32.exe	17
PID 2848 wrote to memory of 2900	2848	rundll32.exe	17
PID 2848 wrote to memory of 2900	2848	rundll32.exe	17
PID 2848 wrote to memory of 2900	2848	rundll32.exe	17

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4216f6459fd0275a0c20b6ba45236cfb22f7f328f42b869203ac389bbec3fbd2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4216f6459fd0275a0c20b6ba45236cfb22f7f328f42b869203ac389bbec3fbd2.dll,#1
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 320
    3⤵
    - Program crash
    PID:2640

\Users\Admin\AppData\Local\Temp\E2EECore.2.7.2.dll

Filesize
1.9MB

MD5
c14521fb1bffa9b92177a9749fe02ad6

SHA1
ea45e357872f9e058869b61b3d57f8741a51b8c5

SHA256
9cfa5284c574def2f154ea3db51614c6ec73261c56502ec7b839ab53579725d2

SHA512
b3bae65531ed34a05ffd10548c66f28b5a165f823973c09db9504b0f4f0658697afe04076188068546de4b17987a4e548c3cc060605306245f57bbf86b0fe421

Download Submit
memory/2900-5-0x00000000001F0000-0x00000000001FB000-memory.dmp

Filesize
44KB

Download
memory/2900-4-0x00000000001F0000-0x00000000001FB000-memory.dmp

Filesize
44KB

Download