cf3064aba957ea5b1674b8251ab1d339f26c5a475c327ad856446f038da23a9a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 22:44

Target
c70a6ffcae2e350250af007cc6384e2c.dll
Size 60KB
Sample240313-2n7aqade68
SHA256 cf3064aba957ea5b1674b8251ab1d339f26c5a475c327ad856446f038da23a9a
MD5 c70a6ffcae2e350250af007cc6384e2c
SHA1 e3c67135a171e6ffa55206cb19125f12fc499556
SHA512 9cb4f6e02e3bf217ac8b29b90c802fa84c50f1bc4a8ce07542b67c8d3ca10b005477f6c26f5a7ece9de5bcee19a9e6f0b15494e22e204c1695f301ed6694a707
SSDEEP 768:HIvm0NFttlB9QXshG+u2P44u0wXxHha5O:ovRFttlBNr3A4u04
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

aspackv2

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

resource	yara_rule
behavioral2/files/0x000a000000023111-2.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4836	DFB4604C.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\DFB4604C.exe	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 3224	4072	rundll32.exe	87
PID 4072 wrote to memory of 3224	4072	rundll32.exe	87
PID 4072 wrote to memory of 3224	4072	rundll32.exe	87
PID 3224 wrote to memory of 4836	3224	rundll32.exe	91
PID 3224 wrote to memory of 4836	3224	rundll32.exe	91
PID 3224 wrote to memory of 4836	3224	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c70a6ffcae2e350250af007cc6384e2c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c70a6ffcae2e350250af007cc6384e2c.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Windows\SysWOW64\DFB4604C.exe
    C:\Windows\system32\DFB4604C.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4836

DFB4604C.exe

Path C:\Windows\SysWOW64\DFB4604C.exe
Size 21KB
SHA256 290a744aafb643c213dac90c3dc88cfbfe72ce6d7d5ea55a0737b7242767a1b2
MD5 cb3305740e9023068b83f623ca221db3
SHA1 30f60e66b7afa5b8b6fbd389abd9b56cca313037
SHA512 97be26195d84266d2b67982383842fbd308fc615a3f551f0bff9c492f8cfb09937d5ba9f2a1110294ccf4f59f91b700b4e57c24364df006112be870233de86c5
SSDEEP 384:4tcxEsDau2wWq2n7moK47ianhjLYQiivAxgr6+e9Pfqbn1:F+u2P44u0wXxHha5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4836-3-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4836-7-0x0000000000400000-0x0000000000410000-memory.dmp

Download