1296fca72509b6a6cfb1fcf0371c853607ac4e4b8ee6fc25b36f0b2eb0a8853c

Analysis

max time kernel
44s
max time network
83s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 23:34

Target

鑫财手机协议全能王/dc.dll
Size

120KB
MD5

f803ad370a8649a143429f179af5f3ab
SHA1

9cc2a5abd97ac494318dc176484fe58518a3f93a
SHA256

890bb63027a57ceab075068400610007941f9d915fbefd473393514cf5e7874c
SHA512

b86be893441d835158642bbf955820298c592b80d2bf06fc3f503a645a1b25db85d9655a364ac271b0a4a3bb568054f4c6d54d930af7470dadc264195f48a825
SSDEEP

3072:uEyUyJubNTIuwYK7FzAOYfDftm4fy6sv8v9Kq1Aow5RVLV9uIIDcq1QQm07l+vdL:umkPkIV/7ntQm07

Score

8^/10

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow	pid	Process
3	1700	rundll32.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
932	1700	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	Process	procid_target
PID 956 wrote to memory of 1700	956	rundll32.exe	28
PID 956 wrote to memory of 1700	956	rundll32.exe	28
PID 956 wrote to memory of 1700	956	rundll32.exe	28
PID 956 wrote to memory of 1700	956	rundll32.exe	28
PID 956 wrote to memory of 1700	956	rundll32.exe	28
PID 956 wrote to memory of 1700	956	rundll32.exe	28
PID 956 wrote to memory of 1700	956	rundll32.exe	28
PID 1700 wrote to memory of 932	1700	rundll32.exe	29
PID 1700 wrote to memory of 932	1700	rundll32.exe	29
PID 1700 wrote to memory of 932	1700	rundll32.exe	29
PID 1700 wrote to memory of 932	1700	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\鑫财手机协议全能王\dc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\鑫财手机协议全能王\dc.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 484
    3⤵
    - Program crash
    PID:932

memory/932-56-0x0000000000000000-mapping.dmp

Download
memory/1700-54-0x0000000000000000-mapping.dmp

Download
memory/1700-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download