Analysis

  • max time kernel
    85s
  • max time network
    30s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    25-11-2022 21:22

General

  • Target

    傳奇守護者免费版1.8.9/detection/boss.dll

  • Size

    1.0MB

  • MD5

    d10df1b05726682a8f3b1eec2f79b7c5

  • SHA1

    c2f6f70623349680b778aafce709f1f6b1e6c76a

  • SHA256

    b18ea2e196cc10efa72d74d17aadf578f6febec139b7cb848d4cb822227b7966

  • SHA512

    9cff94ed34bb66e318e0c33f51b5c7bbed12dd5ea0c9f94bd9c8eb01aeef7a0c5b7dd575257a93f07797a1e3d08c3d507507466ca96af55fcc79ec475ccf29ab

  • SSDEEP

    12288:8oaFLKFyvgN9mAEfpYcUS+xdeumxmp5sVIJlinSlwerIRHvmqRUNzs0d8xhI9A1G:8o2iyvI9hEfplUcRTnrF0sPVu

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\傳奇守護者免费版1.8.9\detection\boss.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1452
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\傳奇守護者免费版1.8.9\detection\boss.dll,#1
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1040
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 272
        3⤵
        • Program crash
        PID:592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/592-63-0x0000000000000000-mapping.dmp

  • memory/1040-54-0x0000000000000000-mapping.dmp

  • memory/1040-55-0x00000000760B1000-0x00000000760B3000-memory.dmp

    Filesize

    8KB

  • memory/1040-56-0x0000000000450000-0x00000000004BF000-memory.dmp

    Filesize

    444KB