20fad721ad99f8a82c2eaf4743229f8c921d00b9ee0caa49c96edfd15156d749

Analysis

max time kernel
26s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
13-10-2022 05:33

Target

新建文件夹/Inet_Download_Manager_v6.37.14_Final/Internet Download Manager/IDMVMPrs.dll
Size

341KB
MD5

1f274d186c29db4078cfd26170760a74
SHA1

b90d30d3ca3804ada23fcd3d7feb2e40691b99a8
SHA256

804a6a9d19eb8a1b09e5b4bb8f3849e8a64480355525374024435349a4fe7f62
SHA512

ca771cb01df448b01b4eac57aa05696d18afe0c4000200455e7f5e6392139702b3d9d3d7130984b2f9fd8c474033a18dab72d8823c71174d7611904f41d2e4cd
SSDEEP

6144:i3mjKuPlUvBOju7JOcS52t8Z5IMpxzjd4C7JIhwEYi/KWF4K:pzPlUvx+5O8kMjQTiWF4K

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1608 1696 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1608	1696	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1548 wrote to memory of 1696	1548	rundll32.exe	rundll32.exe
PID 1548 wrote to memory of 1696	1548	rundll32.exe	rundll32.exe
PID 1548 wrote to memory of 1696	1548	rundll32.exe	rundll32.exe
PID 1548 wrote to memory of 1696	1548	rundll32.exe	rundll32.exe
PID 1548 wrote to memory of 1696	1548	rundll32.exe	rundll32.exe
PID 1548 wrote to memory of 1696	1548	rundll32.exe	rundll32.exe
PID 1548 wrote to memory of 1696	1548	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 1608	1696	rundll32.exe	WerFault.exe
PID 1696 wrote to memory of 1608	1696	rundll32.exe	WerFault.exe
PID 1696 wrote to memory of 1608	1696	rundll32.exe	WerFault.exe
PID 1696 wrote to memory of 1608	1696	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\新建文件夹\Inet_Download_Manager_v6.37.14_Final\Internet Download Manager\IDMVMPrs.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1548

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\新建文件夹\Inet_Download_Manager_v6.37.14_Final\Internet Download Manager\IDMVMPrs.dll",#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 224
3⤵
- Program crash
PID:1608

memory/1608-56-0x0000000000000000-mapping.dmp

Download
memory/1696-54-0x0000000000000000-mapping.dmp

Download
memory/1696-55-0x0000000075561000-0x0000000075563000-memory.dmp

Filesize
8KB

Download