14a3894cd6a6e321d3a07c5b7a2bd22cad174f55feef3b6b6e2279fc5ea66ee8 | Triage

Analysis

max time kernel
138s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 18:48

Sharing

Report Analysis Logs

General

Target

远程监控/dp1.dll
Size

124KB
MD5

a062fbf36321864ac8e7e2e408ff0d90
SHA1

8cc46a09096eb373e5e01d7547f108eb09bbac9d
SHA256

249a27ede8d0fbd3e5dd89b9150d1215c7ae1dc2f137db5a67cee44e6b5c0431
SHA512

2ddb24f7f9a6f6b17b4ac3a5e0b4cfe9424a710ef34c7918754bcd4acff8ff41e043c2e8ab829da42d2e4a80cc45b59f309253833ba3d7329ba79d7fc7128819
SSDEEP

1536:mZZhM+fWvw1CEb18ANf6T/BLL+UTMoV51oFN2w:mZZu4WvjEbTkLlV51o5

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1792 1004 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2548 wrote to memory of 1004	2548	rundll32.exe	rundll32.exe
PID 2548 wrote to memory of 1004	2548	rundll32.exe	rundll32.exe
PID 2548 wrote to memory of 1004	2548	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\远程监控\dp1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2548

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\远程监控\dp1.dll,#1
2⤵
PID:1004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1004 -s 600
3⤵
- Program crash
PID:1792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1004 -ip 1004
1⤵
PID:3896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1004-132-0x0000000000000000-mapping.dmp

Download