4216f6459fd0275a0c20b6ba45236cfb22f7f328f42b869203ac389bbec3fbd2

Analysis

max time kernel
136s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
13/11/2023, 16:56

Target

4216f6459fd0275a0c20b6ba45236cfb22f7f328f42b869203ac389bbec3fbd2.dll
Size

5.0MB
MD5

854ea636a4c56d84025e9d46560e29e5
SHA1

1de2ed653e036dd0cf4aa03d75ea31228f879ade
SHA256

4216f6459fd0275a0c20b6ba45236cfb22f7f328f42b869203ac389bbec3fbd2
SHA512

e60cf559ac14e0454d9995c938a3d1d0b4670144f19b7303d37bad0606a64b9099c8779d1db6c05652cf12705563e7f595f0ca2d22c758b38f6136146ca2a6d5
SSDEEP

98304:4LoSYcJBAUZL26T6F9628sPyYFivvKncMpzJOP:mBJVq6z28whivV

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2924	rundll32.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2924-6-0x00000000007A0000-0x00000000007AB000-memory.dmp	upx
behavioral2/memory/2924-8-0x00000000007A0000-0x00000000007AB000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2924	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 2924	4716	rundll32.exe	41
PID 4716 wrote to memory of 2924	4716	rundll32.exe	41
PID 4716 wrote to memory of 2924	4716	rundll32.exe	41

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4216f6459fd0275a0c20b6ba45236cfb22f7f328f42b869203ac389bbec3fbd2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4216f6459fd0275a0c20b6ba45236cfb22f7f328f42b869203ac389bbec3fbd2.dll,#1
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2924 -ip 2924
1⤵
PID:2292

C:\Users\Admin\AppData\Local\Temp\E2EECore.2.7.2.dll

Filesize
1.9MB

MD5
953e20afd1317cc166bd260253ca97d3

SHA1
06c7f3fad8db7ce73560134e0515b3863e49fa0b

SHA256
d21fa8ad00822f806009d533b35ff6b542df8986b2d5517e5658050646a8d0f4

SHA512
5163162367341aeef599a162ef2e9f1c41434ca9003c4050d43dfbf54935b1abc7752b31b9cb87d435b5c7b3cfaa681f7e756362a739a210bc2578dd163dc9be

Download Submit
memory/2924-6-0x00000000007A0000-0x00000000007AB000-memory.dmp

Filesize
44KB

Download
memory/2924-8-0x00000000007A0000-0x00000000007AB000-memory.dmp

Filesize
44KB

Download