25a1ed638307b5c361a117048961fffb5533a2925553a2cb44ae61fc5389c23e

Analysis

max time kernel
111s
max time network
38s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 04:17

Target

觉醒.dll
Size

112KB
MD5

cee8a9f36b32a0429e0c5bbbfaa0a62d
SHA1

e67d6847b1f021bc1fd3b7af50812b68f09ce3e2
SHA256

cad8564c059307359d0d6e43cadca1246d9637ce8412239c4b4da4e734d3d676
SHA512

bb6a7b7de0ea982d2cfef0866891483c316b66698b175bdebafe6a9b28bd490c9c6c0471ad5390a7278fe0dd98f6a3936f881122b72889b4eababfb3f6649efc
SSDEEP

1536:FhR3GCq9YNyGUTbVOgVij9GcaE1+33R0sR3hOlL4lqNgDl4Z+Dz3LLnq9e4nouy8:jQCq9YNb4ij9GjEo6AOOme8Inq9fout

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral13/memory/1696-0-0x0000000010000000-0x000000001005D000-memory.dmp	upx
behavioral13/memory/1696-1-0x0000000010000000-0x000000001005D000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1696	rundll32.exe
1696	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1696	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 1696	2988	rundll32.exe	29
PID 2988 wrote to memory of 1696	2988	rundll32.exe	29
PID 2988 wrote to memory of 1696	2988	rundll32.exe	29
PID 2988 wrote to memory of 1696	2988	rundll32.exe	29
PID 2988 wrote to memory of 1696	2988	rundll32.exe	29
PID 2988 wrote to memory of 1696	2988	rundll32.exe	29
PID 2988 wrote to memory of 1696	2988	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\觉醒.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\觉醒.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1696

memory/1696-0-0x0000000010000000-0x000000001005D000-memory.dmp

Filesize
372KB

Download
memory/1696-1-0x0000000010000000-0x000000001005D000-memory.dmp

Filesize
372KB

Download
memory/1696-2-0x0000000010000000-0x000000001005D000-memory.dmp

Filesize
372KB

Download