70c2a521275bc55bf655177844375cdb385a58af41c3e6184f1eb007aea573ab | Triage

Analysis

max time kernel
108s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2022, 13:51

Sharing

Report Analysis Logs

General

Target

查找文本的工具/pdfium.dll
Size

3.9MB
MD5

6ab32a9edf06790519e5b12e886e6a85
SHA1

f31cb65778a9aed8f42330c86cb3f1d06617ceb7
SHA256

30643c8902beccde5c0e32942725ba29d5c1f4c0ca1c6c9973c8481be0d81bf9
SHA512

6c97f9e46f195bf9aae8806921b56e47607b149e09ea14f2907d8c2cab92fd9ecd739c71ea54381603589c672a6f6096e1c752beff882872d6d653ec7b473eff
SSDEEP

98304:wH0RKNcPj1jM3CfyS1NW4RRbtRjPaylpwn2CICxE:NRKSjMSySbW43LPawCICx

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
212	4316	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 4316	4828	rundll32.exe	84
PID 4828 wrote to memory of 4316	4828	rundll32.exe	84
PID 4828 wrote to memory of 4316	4828	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\查找文本的工具\pdfium.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\查找文本的工具\pdfium.dll,#1
  2⤵
  PID:4316
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 612
    3⤵
    - Program crash
    PID:212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4316 -ip 4316
1⤵
PID:1052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads