21422f8dffcd0e9191c7af77b416622382e4fd9a1fc38b96ab3e11494e8d9ceb

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 09:04

Target

易语言邮箱客户端/SkinH_EL.dll
Size

95KB
MD5

74643bfcb5506297fc0a08baa172db15
SHA1

d5b8d5a7b9ba10d346a28750f8bce0c5b9fa597b
SHA256

97988664ef4449da37eb18f1c3df31a44a7decd581ae7e35e8078768fc957d9a
SHA512

2a14130822ae0921885e03a4a10de39f9c40da71333036ec1b30747b93991c71d8ce65e6cdd29a77619d44b505489d2c231b498f660a1db0b392aa7f36717b4f
SSDEEP

1536:YCD5ctuIdG6o7z2+kJ1iw3pkaCPh0H8T7QLIXe4J58OTV8b0T+V8OLoBm02FsB7r:ZYfjSz2+kPRpkaCPaH8T7QweW58WVPSY

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral5/memory/2400-0-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral5/memory/2400-1-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral5/memory/2400-2-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral5/memory/2400-3-0x0000000010000000-0x000000001003F000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

2400 rundll32.exe

pid	process
2400	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1200 wrote to memory of 2400	1200	rundll32.exe	rundll32.exe
PID 1200 wrote to memory of 2400	1200	rundll32.exe	rundll32.exe
PID 1200 wrote to memory of 2400	1200	rundll32.exe	rundll32.exe
PID 1200 wrote to memory of 2400	1200	rundll32.exe	rundll32.exe
PID 1200 wrote to memory of 2400	1200	rundll32.exe	rundll32.exe
PID 1200 wrote to memory of 2400	1200	rundll32.exe	rundll32.exe
PID 1200 wrote to memory of 2400	1200	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\易语言邮箱客户端\SkinH_EL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1200

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\易语言邮箱客户端\SkinH_EL.dll,#1
2⤵
- Suspicious use of SetWindowsHookEx
PID:2400

memory/2400-0-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/2400-1-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/2400-2-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/2400-3-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download