70c2a521275bc55bf655177844375cdb385a58af41c3e6184f1eb007aea573ab | Triage

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-09-2022 13:51

Sharing

Report Analysis Logs

General

Target

查找文本的工具/pdfium.dll
Size

3.9MB
MD5

6ab32a9edf06790519e5b12e886e6a85
SHA1

f31cb65778a9aed8f42330c86cb3f1d06617ceb7
SHA256

30643c8902beccde5c0e32942725ba29d5c1f4c0ca1c6c9973c8481be0d81bf9
SHA512

6c97f9e46f195bf9aae8806921b56e47607b149e09ea14f2907d8c2cab92fd9ecd739c71ea54381603589c672a6f6096e1c752beff882872d6d653ec7b473eff
SSDEEP

98304:wH0RKNcPj1jM3CfyS1NW4RRbtRjPaylpwn2CICxE:NRKSjMSySbW43LPawCICx

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
908	536	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 536	768	rundll32.exe	27
PID 768 wrote to memory of 536	768	rundll32.exe	27
PID 768 wrote to memory of 536	768	rundll32.exe	27
PID 768 wrote to memory of 536	768	rundll32.exe	27
PID 768 wrote to memory of 536	768	rundll32.exe	27
PID 768 wrote to memory of 536	768	rundll32.exe	27
PID 768 wrote to memory of 536	768	rundll32.exe	27
PID 536 wrote to memory of 908	536	rundll32.exe	28
PID 536 wrote to memory of 908	536	rundll32.exe	28
PID 536 wrote to memory of 908	536	rundll32.exe	28
PID 536 wrote to memory of 908	536	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\查找文本的工具\pdfium.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\查找文本的工具\pdfium.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:536
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 224
    3⤵
    - Program crash
    PID:908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/536-55-0x0000000076871000-0x0000000076873000-memory.dmp

Filesize
8KB

Download