22b7247ac7d4b0c45798208487a1bfa0ea4c6aac185ed4fbf0bdf267fdf8ceb0 | Triage

Analysis

max time kernel
111s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 23:01

Sharing

Report Analysis Logs

General

Target

DPlayerGR(play.jb51.net)/QtXml4.dll
Size

347KB
MD5

662b511776db4e9fb59d740cd2d18d28
SHA1

699aa8e02b605d7f74248668434e8fdc7997c5b2
SHA256

0c875b667cb90952aa628ae713644b0bbf2413aa3cfa310f8dfdabab1990e06e
SHA512

7c0f7cc3f0ee70e5682c01bb4a234d4f036fc10443d8e63605083a0528e1326a8f96bade2e4b95288a2e07e5f5f63c02f8eb44a23aee4c0d16db4380626d68d9
SSDEEP

6144:akwkS0wEgT8UQzveVai1FT7AFJvWOHSMObx8JK:akwkLwLT8BeVFfAFvs

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
3900	1528	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 3192 wrote to memory of 1528	3192	rundll32.exe	81
PID 3192 wrote to memory of 1528	3192	rundll32.exe	81
PID 3192 wrote to memory of 1528	3192	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DPlayerGR(play.jb51.net)\QtXml4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DPlayerGR(play.jb51.net)\QtXml4.dll,#1
  2⤵
  PID:1528
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 648
    3⤵
    - Program crash
    PID:3900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1528 -ip 1528
1⤵
PID:5056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1528-132-0x0000000000000000-mapping.dmp

Download