8272912ee1bf16a05192042253c37356e5944c0e26795772a14c606565ca58b6

Analysis

max time kernel
137s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 09:05

Target

YY5331过非法VE/dak31.dll
Size

232KB
MD5

23aa676c5b6f91bfffa41cdd28f1afd1
SHA1

ad10842b3f6211b50416c3568b40c2400dbb94e0
SHA256

dc639cf3f8ad5a6875053f3719a88a9f50a18e92a9d3668cd5d8eecd094558ba
SHA512

b9e47522d43ff57b72216ae93c9ea1f53d572d1ee6e28457d8439daf5048024ffd091a38df2fa8ca9869f949efb8c23427d33f0dfc24003a971a4050a77fcfb3
SSDEEP

3072:H12+JqqGu1Bl0t05Np2dlUX0+Cx17F8QRJZKmOK3outKF/Z/A3fe0dSSxmG:HbJq/cBdFwT7SMJMzUoSS/Zsdfx

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral10/memory/4228-3-0x0000000000BE0000-0x0000000000C1D000-memory.dmp	upx
behavioral10/memory/4228-2-0x0000000000BE0000-0x0000000000C1D000-memory.dmp	upx
behavioral10/memory/4228-0-0x0000000000BE0000-0x0000000000C1D000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2336	4228	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 4228	3052	rundll32.exe	14
PID 3052 wrote to memory of 4228	3052	rundll32.exe	14
PID 3052 wrote to memory of 4228	3052	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\YY5331过非法VE\dak31.dll,#1
1⤵
PID:4228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 600
  2⤵
  - Program crash
  PID:2336

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\YY5331过非法VE\dak31.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4228 -ip 4228
1⤵
PID:1232

memory/4228-3-0x0000000000BE0000-0x0000000000C1D000-memory.dmp

Filesize
244KB

Download
memory/4228-2-0x0000000000BE0000-0x0000000000C1D000-memory.dmp

Filesize
244KB

Download
memory/4228-0-0x0000000000BE0000-0x0000000000C1D000-memory.dmp

Filesize
244KB

Download