56921843b5aa3ca1c6c231ef1bee879a0c3d19f2e3ce5c8acab07151825f2bd3

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 13:51

Target

gexgg_-10-502/通用的逐鹿中原登陆器配置器/服务端插件/yinling.dll
Size

733KB
MD5

c019a810708f59e00b91a2367d56de35
SHA1

37998b58ed2ad531b521614b9b29b63435e8686a
SHA256

0eb1cb13f03316c30a3f925d86abd16dd69a7643817aa80d4fb7746e1e7408c2
SHA512

7bbafb5d90115e0af2d5e50e24a29be0b10db37709ae746527807a8fee32b16316e9103e17e4a06947c78a0821ef1c123503f53ddfb5496a1cd5cfb4fd1c229b
SSDEEP

12288:9hebLtZ+a5h+ewHFNc4imkkfXgBkSKCxl/JXOtVDXHiWdt5w:vefnb+/s4P7fwqSKynOv1

Score

7^/10

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00070000000122c9-1.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
1792	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\V22006115.EPE	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1792	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 1792	1520	rundll32.exe	28
PID 1520 wrote to memory of 1792	1520	rundll32.exe	28
PID 1520 wrote to memory of 1792	1520	rundll32.exe	28
PID 1520 wrote to memory of 1792	1520	rundll32.exe	28
PID 1520 wrote to memory of 1792	1520	rundll32.exe	28
PID 1520 wrote to memory of 1792	1520	rundll32.exe	28
PID 1520 wrote to memory of 1792	1520	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gexgg_-10-502\通用的逐鹿中原登陆器配置器\服务端插件\yinling.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\gexgg_-10-502\通用的逐鹿中原登陆器配置器\服务端插件\yinling.dll,#1
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:1792

\Windows\SysWOW64\V22006115.EPE

Filesize
429KB

MD5
0b20089dea2d38713e7091fb85eb8d78

SHA1
0496e0f7e0c6f5530dd14e2398b5caadee38181d

SHA256
501b1a750e0f046220d24a801b174e439187f2aa4ada8075c301886922ddf84e

SHA512
776d9e3ef14d15846e9270c74b1202705cbfeae45689ad04315349e513390c685ab70a682c24bb2e225621013fe268ba9668b6f731eaec735317259ae357f86c

Download Submit
memory/1792-0-0x0000000000AB0000-0x0000000000C01000-memory.dmp

Filesize
1.3MB

Download
memory/1792-2-0x0000000000AB0000-0x0000000000C01000-memory.dmp

Filesize
1.3MB

Download
memory/1792-3-0x0000000071120000-0x000000007123B000-memory.dmp

Filesize
1.1MB

Download