25a1ed638307b5c361a117048961fffb5533a2925553a2cb44ae61fc5389c23e

Analysis

max time kernel
158s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 04:17

Target

冒火.dll
Size

112KB
MD5

9ae2099c3940fa5a0a48c3869257dffa
SHA1

60baa2301763bf6887296bfd5ef461bc1a183aae
SHA256

e24c82390b05446efe5d82bd5392c6d6d207efc44f6e0c870117a5f1720b181a
SHA512

f4c1e7cbfe0932e0e0c99eecb827c82c144cd7514ac563f517b2ede3d0c25c2b194adf4ea1105cc4873a20e6bfad81d32ccd913d2ea5c1b3f1298503457d4262
SSDEEP

1536:vOPM3eJ3KYc4xMAzUVQlrRrzPiQN+2gkldlaR6c3OEz5Wro936dbWWwsbPlmGIbq:WP7J6YV4YlPi1cxI5WrYmhI5antout

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral10/memory/4852-0-0x0000000010000000-0x000000001005D000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4852	rundll32.exe
4852	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4852	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 4852	3408	rundll32.exe	22
PID 3408 wrote to memory of 4852	3408	rundll32.exe	22
PID 3408 wrote to memory of 4852	3408	rundll32.exe	22

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\冒火.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\冒火.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4852

memory/4852-0-0x0000000010000000-0x000000001005D000-memory.dmp

Filesize
372KB

Download