9eef6e2d4e5d2511a3fb86645bc5ae5d239a58da5b5650470a5deece1c731668

Analysis

max time kernel
85s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 21:22

Target

傳奇守護者免费版1.8.9/detection/boss.dll
Size

1.0MB
MD5

d10df1b05726682a8f3b1eec2f79b7c5
SHA1

c2f6f70623349680b778aafce709f1f6b1e6c76a
SHA256

b18ea2e196cc10efa72d74d17aadf578f6febec139b7cb848d4cb822227b7966
SHA512

9cff94ed34bb66e318e0c33f51b5c7bbed12dd5ea0c9f94bd9c8eb01aeef7a0c5b7dd575257a93f07797a1e3d08c3d507507466ca96af55fcc79ec475ccf29ab
SSDEEP

12288:8oaFLKFyvgN9mAEfpYcUS+xdeumxmp5sVIJlinSlwerIRHvmqRUNzs0d8xhI9A1G:8o2iyvI9hEfplUcRTnrF0sPVu

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

592 1040 WerFault.exe rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1040 rundll32.exe

pid	pid_target	process	target process
592	1040	WerFault.exe	rundll32.exe

pid	process
1040	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1452 wrote to memory of 1040	1452	rundll32.exe	rundll32.exe
PID 1452 wrote to memory of 1040	1452	rundll32.exe	rundll32.exe
PID 1452 wrote to memory of 1040	1452	rundll32.exe	rundll32.exe
PID 1452 wrote to memory of 1040	1452	rundll32.exe	rundll32.exe
PID 1452 wrote to memory of 1040	1452	rundll32.exe	rundll32.exe
PID 1452 wrote to memory of 1040	1452	rundll32.exe	rundll32.exe
PID 1452 wrote to memory of 1040	1452	rundll32.exe	rundll32.exe
PID 1040 wrote to memory of 592	1040	rundll32.exe	WerFault.exe
PID 1040 wrote to memory of 592	1040	rundll32.exe	WerFault.exe
PID 1040 wrote to memory of 592	1040	rundll32.exe	WerFault.exe
PID 1040 wrote to memory of 592	1040	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\傳奇守護者免费版1.8.9\detection\boss.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 272
3⤵
- Program crash
PID:592

memory/592-63-0x0000000000000000-mapping.dmp

Download
memory/1040-54-0x0000000000000000-mapping.dmp

Download
memory/1040-55-0x00000000760B1000-0x00000000760B3000-memory.dmp

Filesize
8KB

Download
memory/1040-56-0x0000000000450000-0x00000000004BF000-memory.dmp

Filesize
444KB

Download