30fe745e9fb94f50cdf702f28218bbcd105db9e341a7f78ac9811a9fbda628f3

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 17:34

Target

QQkjmfmhklq/QQ空间免费美化克隆器/Skin.dll
Size

85KB
MD5

a5bb013c132f1fbbced475a7720c8727
SHA1

68b100ca811286afb1176dadcf482b34e8c34a9e
SHA256

e5fab9187248503ce972e9f6e929512ec5673aa112c62de632f610c438dd7e57
SHA512

5d8274c43c8086e7bfe604a0d52606c0d804c5c3add3fec6315fdeb1c038127e649f9390ec978a1c1f40aaf41922c6ea55ab3761b437be6128118c220e58dfcf
SSDEEP

1536:obZvHATuOMDswejV9pYaN29BSSWfJLv/GBLG4xmha6wezjrcQynouy88:8FAL+/oX5hLv/GBLYa6Lj4Qqout8

Score

7^/10

upx

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral3/memory/2952-0-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral3/memory/2952-2-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral3/memory/2952-1-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral3/memory/2952-4-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral3/memory/2952-5-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral3/memory/2952-6-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3056	2952	WerFault.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2952	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2952	2956	rundll32.exe	28
PID 2956 wrote to memory of 2952	2956	rundll32.exe	28
PID 2956 wrote to memory of 2952	2956	rundll32.exe	28
PID 2956 wrote to memory of 2952	2956	rundll32.exe	28
PID 2956 wrote to memory of 2952	2956	rundll32.exe	28
PID 2956 wrote to memory of 2952	2956	rundll32.exe	28
PID 2956 wrote to memory of 2952	2956	rundll32.exe	28
PID 2952 wrote to memory of 3056	2952	rundll32.exe	29
PID 2952 wrote to memory of 3056	2952	rundll32.exe	29
PID 2952 wrote to memory of 3056	2952	rundll32.exe	29
PID 2952 wrote to memory of 3056	2952	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQkjmfmhklq\QQ空间免费美化克隆器\Skin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQkjmfmhklq\QQ空间免费美化克隆器\Skin.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 248
    3⤵
    - Program crash
    PID:3056

memory/2952-0-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2952-2-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2952-1-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2952-4-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2952-3-0x0000000010009000-0x000000001000A000-memory.dmp

Filesize
4KB

Download
memory/2952-5-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2952-6-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download