9eef6e2d4e5d2511a3fb86645bc5ae5d239a58da5b5650470a5deece1c731668

Analysis

max time kernel
38s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 21:22

Target

傳奇守護者免费版1.8.9/detection/passWs.dll
Size

430KB
MD5

55342de35b22374c9f71e7611503af86
SHA1

359b98553dd6feccd24ee976842764befbf087e5
SHA256

296bb64ccf5b12973f163d809a605cd9d7d80f7a6662a295d9d7a51111be6a75
SHA512

190ec3392e73c1eb8686638ceb100a9c6e496f2707a90d690940dbc79963a70354643e538e75fc42466b17be06cfe1645a867f6588e00a9a3661e5d7f245ad3d
SSDEEP

6144:qIrG2ZxmdksT5tx8NOyrjhSSrmUgpYSTgoTx1JMi1jzEX5Lr1qRLCbVbE0mq5+Fe:q5K+FXAZqELxy1DjTt

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1728 1776 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1776 rundll32.exe

pid	pid_target	process	target process
1728	1776	WerFault.exe	rundll32.exe

pid	process
1776	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1392 wrote to memory of 1776	1392	rundll32.exe	rundll32.exe
PID 1392 wrote to memory of 1776	1392	rundll32.exe	rundll32.exe
PID 1392 wrote to memory of 1776	1392	rundll32.exe	rundll32.exe
PID 1392 wrote to memory of 1776	1392	rundll32.exe	rundll32.exe
PID 1392 wrote to memory of 1776	1392	rundll32.exe	rundll32.exe
PID 1392 wrote to memory of 1776	1392	rundll32.exe	rundll32.exe
PID 1392 wrote to memory of 1776	1392	rundll32.exe	rundll32.exe
PID 1776 wrote to memory of 1728	1776	rundll32.exe	WerFault.exe
PID 1776 wrote to memory of 1728	1776	rundll32.exe	WerFault.exe
PID 1776 wrote to memory of 1728	1776	rundll32.exe	WerFault.exe
PID 1776 wrote to memory of 1728	1776	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\傳奇守護者免费版1.8.9\detection\passWs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 272
3⤵
- Program crash
PID:1728

memory/1728-56-0x0000000000000000-mapping.dmp

Download
memory/1776-54-0x0000000000000000-mapping.dmp

Download
memory/1776-55-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download