9eef6e2d4e5d2511a3fb86645bc5ae5d239a58da5b5650470a5deece1c731668

Analysis

max time kernel
177s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 21:22

Target

傳奇守護者免费版1.8.9/detection/passWs.dll
Size

430KB
MD5

55342de35b22374c9f71e7611503af86
SHA1

359b98553dd6feccd24ee976842764befbf087e5
SHA256

296bb64ccf5b12973f163d809a605cd9d7d80f7a6662a295d9d7a51111be6a75
SHA512

190ec3392e73c1eb8686638ceb100a9c6e496f2707a90d690940dbc79963a70354643e538e75fc42466b17be06cfe1645a867f6588e00a9a3661e5d7f245ad3d
SSDEEP

6144:qIrG2ZxmdksT5tx8NOyrjhSSrmUgpYSTgoTx1JMi1jzEX5Lr1qRLCbVbE0mq5+Fe:q5K+FXAZqELxy1DjTt

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2752 4448 WerFault.exe rundll32.exe
2084 4448 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

4448 rundll32.exe
4448 rundll32.exe

pid	pid_target	process	target process
2752	4448	WerFault.exe	rundll32.exe
2084	4448	WerFault.exe	rundll32.exe

pid	process
4448	rundll32.exe
4448	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5048 wrote to memory of 4448	5048	rundll32.exe	rundll32.exe
PID 5048 wrote to memory of 4448	5048	rundll32.exe	rundll32.exe
PID 5048 wrote to memory of 4448	5048	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\傳奇守護者免费版1.8.9\detection\passWs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5048

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\傳奇守護者免费版1.8.9\detection\passWs.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 580
3⤵
- Program crash
PID:2752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 816
3⤵
- Program crash
PID:2084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4448 -ip 4448
1⤵
PID:896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4448 -ip 4448
1⤵
PID:2900