dc7dc69d4ed0d65725d47e55415a29ce8794f120a0f19d1c4acebfe51cb002cb

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 20:32

Target

rpkeylogger-0.1/bin/Hook.dll
Size

19KB
MD5

f6a8d3589ae290f11da288901e0b105e
SHA1

f1e58909ff6684f30e9d87852903cd3f30ceec9a
SHA256

50adce109cf19f5fe288498361b5c2d98d4d9b5949e66e814103cee195f68c96
SHA512

f6f0e225b0bcfd0b9a73d1ff8c333a28601a5db55a1bc5ba1e7e350b3fa4bb03999941d32cd6023f0b044cc055abf536946bd8181a5de214db2d8cf2817484fa
SSDEEP

384:uQqIa2OGOxNhPZgfCD+H3BouXAHmHo6HRb6HHwlP:/NeNhBgK6uuXvFHIHw9

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral3/memory/2772-0-0x0000000010000000-0x0000000010011000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2996	2772	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2772	2008	rundll32.exe	28
PID 2008 wrote to memory of 2772	2008	rundll32.exe	28
PID 2008 wrote to memory of 2772	2008	rundll32.exe	28
PID 2008 wrote to memory of 2772	2008	rundll32.exe	28
PID 2008 wrote to memory of 2772	2008	rundll32.exe	28
PID 2008 wrote to memory of 2772	2008	rundll32.exe	28
PID 2008 wrote to memory of 2772	2008	rundll32.exe	28
PID 2772 wrote to memory of 2996	2772	rundll32.exe	29
PID 2772 wrote to memory of 2996	2772	rundll32.exe	29
PID 2772 wrote to memory of 2996	2772	rundll32.exe	29
PID 2772 wrote to memory of 2996	2772	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\rpkeylogger-0.1\bin\Hook.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\rpkeylogger-0.1\bin\Hook.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 224
    3⤵
    - Program crash
    PID:2996

memory/2772-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download