30fe745e9fb94f50cdf702f28218bbcd105db9e341a7f78ac9811a9fbda628f3

Analysis

max time kernel
133s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 17:34

Target

QQkjmfmhklq/QQ空间免费美化克隆器/Skin.dll
Size

85KB
MD5

a5bb013c132f1fbbced475a7720c8727
SHA1

68b100ca811286afb1176dadcf482b34e8c34a9e
SHA256

e5fab9187248503ce972e9f6e929512ec5673aa112c62de632f610c438dd7e57
SHA512

5d8274c43c8086e7bfe604a0d52606c0d804c5c3add3fec6315fdeb1c038127e649f9390ec978a1c1f40aaf41922c6ea55ab3761b437be6128118c220e58dfcf
SSDEEP

1536:obZvHATuOMDswejV9pYaN29BSSWfJLv/GBLG4xmha6wezjrcQynouy88:8FAL+/oX5hLv/GBLYa6Lj4Qqout8

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral4/memory/2364-0-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral4/memory/2364-2-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral4/memory/2364-3-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral4/memory/2364-4-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2428	2364	WerFault.exe	92

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2364	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 2364	3240	rundll32.exe	92
PID 3240 wrote to memory of 2364	3240	rundll32.exe	92
PID 3240 wrote to memory of 2364	3240	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQkjmfmhklq\QQ空间免费美化克隆器\Skin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQkjmfmhklq\QQ空间免费美化克隆器\Skin.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2364
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 644
    3⤵
    - Program crash
    PID:2428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2364 -ip 2364
1⤵
PID:3616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4204,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:8
1⤵
PID:4292

memory/2364-0-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2364-1-0x0000000010009000-0x000000001000A000-memory.dmp

Filesize
4KB

Download
memory/2364-2-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2364-3-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2364-4-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download