9eef6e2d4e5d2511a3fb86645bc5ae5d239a58da5b5650470a5deece1c731668

Analysis

max time kernel
132s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 21:22

Target

傳奇守護者免费版1.8.9/detection/boss.dll
Size

1.0MB
MD5

d10df1b05726682a8f3b1eec2f79b7c5
SHA1

c2f6f70623349680b778aafce709f1f6b1e6c76a
SHA256

b18ea2e196cc10efa72d74d17aadf578f6febec139b7cb848d4cb822227b7966
SHA512

9cff94ed34bb66e318e0c33f51b5c7bbed12dd5ea0c9f94bd9c8eb01aeef7a0c5b7dd575257a93f07797a1e3d08c3d507507466ca96af55fcc79ec475ccf29ab
SSDEEP

12288:8oaFLKFyvgN9mAEfpYcUS+xdeumxmp5sVIJlinSlwerIRHvmqRUNzs0d8xhI9A1G:8o2iyvI9hEfplUcRTnrF0sPVu

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4940 4316 WerFault.exe rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

4316 rundll32.exe

pid	pid_target	process	target process
4940	4316	WerFault.exe	rundll32.exe

pid	process
4316	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3892 wrote to memory of 4316	3892	rundll32.exe	rundll32.exe
PID 3892 wrote to memory of 4316	3892	rundll32.exe	rundll32.exe
PID 3892 wrote to memory of 4316	3892	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\傳奇守護者免费版1.8.9\detection\boss.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3892

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\傳奇守護者免费版1.8.9\detection\boss.dll,#1
2⤵
- Suspicious use of SetWindowsHookEx
PID:4316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 696
3⤵
- Program crash
PID:4940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4316 -ip 4316
1⤵
PID:4772

memory/4316-132-0x0000000000000000-mapping.dmp

Download
memory/4316-133-0x0000000002530000-0x000000000259F000-memory.dmp

Filesize
444KB

Download