14a3894cd6a6e321d3a07c5b7a2bd22cad174f55feef3b6b6e2279fc5ea66ee8 | Triage

Analysis

max time kernel
31s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 18:48

Sharing

Report Analysis Logs

General

Target

远程监控/dp1.dll
Size

124KB
MD5

a062fbf36321864ac8e7e2e408ff0d90
SHA1

8cc46a09096eb373e5e01d7547f108eb09bbac9d
SHA256

249a27ede8d0fbd3e5dd89b9150d1215c7ae1dc2f137db5a67cee44e6b5c0431
SHA512

2ddb24f7f9a6f6b17b4ac3a5e0b4cfe9424a710ef34c7918754bcd4acff8ff41e043c2e8ab829da42d2e4a80cc45b59f309253833ba3d7329ba79d7fc7128819
SSDEEP

1536:mZZhM+fWvw1CEb18ANf6T/BLL+UTMoV51oFN2w:mZZu4WvjEbTkLlV51o5

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1272 1284 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1308 wrote to memory of 1284	1308	rundll32.exe	rundll32.exe
PID 1308 wrote to memory of 1284	1308	rundll32.exe	rundll32.exe
PID 1308 wrote to memory of 1284	1308	rundll32.exe	rundll32.exe
PID 1308 wrote to memory of 1284	1308	rundll32.exe	rundll32.exe
PID 1308 wrote to memory of 1284	1308	rundll32.exe	rundll32.exe
PID 1308 wrote to memory of 1284	1308	rundll32.exe	rundll32.exe
PID 1308 wrote to memory of 1284	1308	rundll32.exe	rundll32.exe
PID 1284 wrote to memory of 1272	1284	rundll32.exe	WerFault.exe
PID 1284 wrote to memory of 1272	1284	rundll32.exe	WerFault.exe
PID 1284 wrote to memory of 1272	1284	rundll32.exe	WerFault.exe
PID 1284 wrote to memory of 1272	1284	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\远程监控\dp1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1308

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\远程监控\dp1.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1284 -s 228
3⤵
- Program crash
PID:1272

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1272-56-0x0000000000000000-mapping.dmp

Download
memory/1284-54-0x0000000000000000-mapping.dmp

Download
memory/1284-55-0x0000000075661000-0x0000000075663000-memory.dmp

Filesize
8KB

Download