25a1ed638307b5c361a117048961fffb5533a2925553a2cb44ae61fc5389c23e

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 04:17

Target

风暴.dll
Size

112KB
MD5

fc6abe71583729f07a5ef6ff9cb04b6c
SHA1

dcd8001a3beb19cee3b952462b3c2975c2caf172
SHA256

0ddd12750d0614132c5665305eb0c6333239b8af63034091c6bf2364e170c9d0
SHA512

0281e195f1fc96588a7f9acf7c1bae8af372362eed12c9d7ff441e96f5c5f245206ed43321dcaaf71303b40e25a069a60fa4b4d1000680e8b5c129f77d5b8160
SSDEEP

3072:bjMom/EgVokvF1IfMDtEoUHgGSVYRlout:XMdcgV1vPoMDtEj9SkoS

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral15/memory/2156-1-0x0000000010000000-0x000000001005D000-memory.dmp	upx
behavioral15/memory/2156-0-0x0000000010000000-0x000000001005D000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2156	rundll32.exe
2156	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2156	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2156	2164	rundll32.exe	14
PID 2164 wrote to memory of 2156	2164	rundll32.exe	14
PID 2164 wrote to memory of 2156	2164	rundll32.exe	14
PID 2164 wrote to memory of 2156	2164	rundll32.exe	14
PID 2164 wrote to memory of 2156	2164	rundll32.exe	14
PID 2164 wrote to memory of 2156	2164	rundll32.exe	14
PID 2164 wrote to memory of 2156	2164	rundll32.exe	14

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\风暴.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2164

memory/2156-2-0x0000000010000000-0x000000001005D000-memory.dmp

Filesize
372KB

Download
memory/2156-1-0x0000000010000000-0x000000001005D000-memory.dmp

Filesize
372KB

Download
memory/2156-0-0x0000000010000000-0x000000001005D000-memory.dmp

Filesize
372KB

Download