5ffbf12675bb0a3af407a83e83d85adee93e4fb76154f43340963d4f621a9a43

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 11:04

Target

UI_6.dll
Size

85KB
MD5

a5bb013c132f1fbbced475a7720c8727
SHA1

68b100ca811286afb1176dadcf482b34e8c34a9e
SHA256

e5fab9187248503ce972e9f6e929512ec5673aa112c62de632f610c438dd7e57
SHA512

5d8274c43c8086e7bfe604a0d52606c0d804c5c3add3fec6315fdeb1c038127e649f9390ec978a1c1f40aaf41922c6ea55ab3761b437be6128118c220e58dfcf
SSDEEP

1536:obZvHATuOMDswejV9pYaN29BSSWfJLv/GBLG4xmha6wezjrcQynouy88:8FAL+/oX5hLv/GBLYa6Lj4Qqout8

Score

7^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral19/memory/2824-0-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral19/memory/2824-4-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral19/memory/2824-3-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral19/memory/2824-1-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral19/memory/2824-5-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2248	2824	WerFault.exe	30

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2824	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2824	1984	rundll32.exe	30
PID 1984 wrote to memory of 2824	1984	rundll32.exe	30
PID 1984 wrote to memory of 2824	1984	rundll32.exe	30
PID 1984 wrote to memory of 2824	1984	rundll32.exe	30
PID 1984 wrote to memory of 2824	1984	rundll32.exe	30
PID 1984 wrote to memory of 2824	1984	rundll32.exe	30
PID 1984 wrote to memory of 2824	1984	rundll32.exe	30
PID 2824 wrote to memory of 2248	2824	rundll32.exe	31
PID 2824 wrote to memory of 2248	2824	rundll32.exe	31
PID 2824 wrote to memory of 2248	2824	rundll32.exe	31
PID 2824 wrote to memory of 2248	2824	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\UI_6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\UI_6.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 248
    3⤵
    - Program crash
    PID:2248

memory/2824-0-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2824-4-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2824-3-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2824-2-0x0000000010009000-0x000000001000A000-memory.dmp

Filesize
4KB

Download
memory/2824-1-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2824-5-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download