8df2b918b0949b6c1e8296c8bd38d31bfb2f5501d0e2e2bc897bf64cbe04a161

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2023 16:26

Target

DNF-XHA V3.[2].0版(可单刷)/HAHook.dll
Size

61KB
MD5

409ec7aa3f50b936efa770a0995dc761
SHA1

d10e368bb8c67d7ae319b3c787d14d5256c045a9
SHA256

3cee0dbb2edb73360da75b830594e4a271157308b8a400c70f5ba150309022d9
SHA512

b4c7dac4d972d37597e7be4363c58aa85c7e79b4c5ddee2379a0340803eda40e0560216a4dff5aa526c062d99a4d47e3f3110910efefaa8c45ce53196bc70491
SSDEEP

1536:EkSotFjO0bll3QCQasjLH2WS75Hh7gYaDhIxNIpxG0dRXKYnouy81:EDebllYvWWSzsYGIKndR6Qout1

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral4/memory/3196-0-0x0000000010000000-0x000000001002D000-memory.dmp	upx
behavioral4/memory/3196-1-0x0000000010000000-0x000000001002D000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2716	3196	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 3196	4772	rundll32.exe	87
PID 4772 wrote to memory of 3196	4772	rundll32.exe	87
PID 4772 wrote to memory of 3196	4772	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\DNF-XHA V3.[2].0版(可单刷)\HAHook.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\DNF-XHA V3.[2].0版(可单刷)\HAHook.dll",#1
  2⤵
  PID:3196
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 616
    3⤵
    - Program crash
    PID:2716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3196 -ip 3196
1⤵
PID:4816

memory/3196-0-0x0000000010000000-0x000000001002D000-memory.dmp

Filesize
180KB

Download
memory/3196-1-0x0000000010000000-0x000000001002D000-memory.dmp

Filesize
180KB

Download