8df2b918b0949b6c1e8296c8bd38d31bfb2f5501d0e2e2bc897bf64cbe04a161

Analysis

max time kernel
144s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 16:26

Target

DNF-XHA V3.[2].0版(可单刷)/HAHook.dll
Size

61KB
MD5

409ec7aa3f50b936efa770a0995dc761
SHA1

d10e368bb8c67d7ae319b3c787d14d5256c045a9
SHA256

3cee0dbb2edb73360da75b830594e4a271157308b8a400c70f5ba150309022d9
SHA512

b4c7dac4d972d37597e7be4363c58aa85c7e79b4c5ddee2379a0340803eda40e0560216a4dff5aa526c062d99a4d47e3f3110910efefaa8c45ce53196bc70491
SSDEEP

1536:EkSotFjO0bll3QCQasjLH2WS75Hh7gYaDhIxNIpxG0dRXKYnouy81:EDebllYvWWSzsYGIKndR6Qout1

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral3/memory/2772-0-0x0000000010000000-0x000000001002D000-memory.dmp	upx
behavioral3/memory/2772-2-0x0000000010000000-0x000000001002D000-memory.dmp	upx
behavioral3/memory/2772-1-0x0000000010000000-0x000000001002D000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2172	2772	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 2772	1820	rundll32.exe	28
PID 1820 wrote to memory of 2772	1820	rundll32.exe	28
PID 1820 wrote to memory of 2772	1820	rundll32.exe	28
PID 1820 wrote to memory of 2772	1820	rundll32.exe	28
PID 1820 wrote to memory of 2772	1820	rundll32.exe	28
PID 1820 wrote to memory of 2772	1820	rundll32.exe	28
PID 1820 wrote to memory of 2772	1820	rundll32.exe	28
PID 2772 wrote to memory of 2172	2772	rundll32.exe	29
PID 2772 wrote to memory of 2172	2772	rundll32.exe	29
PID 2772 wrote to memory of 2172	2772	rundll32.exe	29
PID 2772 wrote to memory of 2172	2772	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\DNF-XHA V3.[2].0版(可单刷)\HAHook.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\DNF-XHA V3.[2].0版(可单刷)\HAHook.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 232
    3⤵
    - Program crash
    PID:2172

memory/2772-0-0x0000000010000000-0x000000001002D000-memory.dmp

Filesize
180KB

Download
memory/2772-2-0x0000000010000000-0x000000001002D000-memory.dmp

Filesize
180KB

Download
memory/2772-1-0x0000000010000000-0x000000001002D000-memory.dmp

Filesize
180KB

Download