b75ff60aaccd7c025a5a2d27afc266bf23808cf46840a4bc868859f0902e09a8

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 15:27

Target

TwistedBrush/sketeng.dll
Size

552KB
MD5

764df5a3305ed790269bf6f5f59589c3
SHA1

08215ba96738559384b99d27a1586b420d7c4cc8
SHA256

f75efc266e9cd6d319e8be8932452c26494daf2a5600989c894c6a8e1c882f45
SHA512

deda227c816559a32a6c4c1eb6d311f631e90b6358331448723ad6a4346531b9846131607cd021f1aafa9f293e56f182724ebb3dd357882e6dedf7f7a7e16206
SSDEEP

12288:4DPWZmWb8NPmQEasMZhhrwnv2DCUAWJdd:4DPWPafrwv2+

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral21/memory/2476-2-0x0000000001FE0000-0x00000000021F2000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2476	2936	rundll32.exe	28
PID 2936 wrote to memory of 2476	2936	rundll32.exe	28
PID 2936 wrote to memory of 2476	2936	rundll32.exe	28
PID 2936 wrote to memory of 2476	2936	rundll32.exe	28
PID 2936 wrote to memory of 2476	2936	rundll32.exe	28
PID 2936 wrote to memory of 2476	2936	rundll32.exe	28
PID 2936 wrote to memory of 2476	2936	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\TwistedBrush\sketeng.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\TwistedBrush\sketeng.dll,#1
  2⤵
  PID:2476

memory/2476-0-0x0000000000160000-0x0000000000170000-memory.dmp

Filesize
64KB

Download
memory/2476-2-0x0000000001FE0000-0x00000000021F2000-memory.dmp

Filesize
2.1MB

Download
memory/2476-1-0x0000000002200000-0x00000000023EB000-memory.dmp

Filesize
1.9MB

Download
memory/2476-4-0x0000000000310000-0x0000000000376000-memory.dmp

Filesize
408KB

Download
memory/2476-6-0x0000000001DE0000-0x0000000001EF5000-memory.dmp

Filesize
1.1MB

Download
memory/2476-7-0x00000000023F0000-0x000000000252D000-memory.dmp

Filesize
1.2MB

Download