8272912ee1bf16a05192042253c37356e5944c0e26795772a14c606565ca58b6

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 09:05

Target

YY5331过非法VE/dak31.dll
Size

232KB
MD5

23aa676c5b6f91bfffa41cdd28f1afd1
SHA1

ad10842b3f6211b50416c3568b40c2400dbb94e0
SHA256

dc639cf3f8ad5a6875053f3719a88a9f50a18e92a9d3668cd5d8eecd094558ba
SHA512

b9e47522d43ff57b72216ae93c9ea1f53d572d1ee6e28457d8439daf5048024ffd091a38df2fa8ca9869f949efb8c23427d33f0dfc24003a971a4050a77fcfb3
SSDEEP

3072:H12+JqqGu1Bl0t05Np2dlUX0+Cx17F8QRJZKmOK3outKF/Z/A3fe0dSSxmG:HbJq/cBdFwT7SMJMzUoSS/Zsdfx

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral9/memory/2476-4-0x00000000001F0000-0x000000000022D000-memory.dmp	upx
behavioral9/memory/2476-2-0x00000000001F0000-0x000000000022D000-memory.dmp	upx
behavioral9/memory/2476-3-0x00000000001F0000-0x000000000022D000-memory.dmp	upx
behavioral9/memory/2476-0-0x00000000001F0000-0x000000000022D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2476	1712	rundll32.exe	14
PID 1712 wrote to memory of 2476	1712	rundll32.exe	14
PID 1712 wrote to memory of 2476	1712	rundll32.exe	14
PID 1712 wrote to memory of 2476	1712	rundll32.exe	14
PID 1712 wrote to memory of 2476	1712	rundll32.exe	14
PID 1712 wrote to memory of 2476	1712	rundll32.exe	14
PID 1712 wrote to memory of 2476	1712	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\YY5331过非法VE\dak31.dll,#1
1⤵
PID:2476

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\YY5331过非法VE\dak31.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1712

memory/2476-4-0x00000000001F0000-0x000000000022D000-memory.dmp

Filesize
244KB

Download
memory/2476-2-0x00000000001F0000-0x000000000022D000-memory.dmp

Filesize
244KB

Download
memory/2476-3-0x00000000001F0000-0x000000000022D000-memory.dmp

Filesize
244KB

Download
memory/2476-0-0x00000000001F0000-0x000000000022D000-memory.dmp

Filesize
244KB

Download