a67841ce6c21b1e48913310654d1501e691052a92369dfcefa1f24690e834ed4

Analysis

max time kernel
51s
max time network
62s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 19:39

Target

PP2008/funcmod/xed2k.dll
Size

476KB
MD5

b3cdb72219fe08da71419e29f5bdced7
SHA1

5dea7f38f8c7089bf8a36865ff990aacabf86e3d
SHA256

583dcd9ef9bfe898028ba2e32fe431bdb9350e41d5b03bba1f771884fb3da942
SHA512

01d2538ff872c1737720ca39a59811f448428e5c561390246542ea413e59b3930909e4f21e006d3b611d40acdafaca728349962df096cf2bcb7f9278b0d7ae74
SSDEEP

6144:YugPGhIE+ZkcpnVaTxttHadx4Qz/U7S99hM9u2T2COru6cWXKNoqJLb4e:YuguhIE+h41HoTh99h/2fTQKNjb4e

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\lang\zh_cn.lang	rundll32.exe
File created	C:\Windows\SysWOW64\config\lang\en_us.lang	rundll32.exe

Modifies registry class 7 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ed2k\shell\open\command\ = "\"C:\\Windows\\SysWOW64\\rundll32.exe\" \"%L\""	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ed2k	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ed2k\ = "URL:eDonkey2000 Protocol"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ed2k\URL Protocol	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ed2k\shell	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ed2k\shell\open	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ed2k\shell\open\command	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1924	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 1924	2484	rundll32.exe	81
PID 2484 wrote to memory of 1924	2484	rundll32.exe	81
PID 2484 wrote to memory of 1924	2484	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PP2008\funcmod\xed2k.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PP2008\funcmod\xed2k.dll,#1
  2⤵
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1924