1296fca72509b6a6cfb1fcf0371c853607ac4e4b8ee6fc25b36f0b2eb0a8853c | Triage

Analysis

max time kernel
81s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 23:34

Sharing

Report Analysis Logs

General

Target

鑫财手机协议全能王/dc.dll
Size

120KB
MD5

f803ad370a8649a143429f179af5f3ab
SHA1

9cc2a5abd97ac494318dc176484fe58518a3f93a
SHA256

890bb63027a57ceab075068400610007941f9d915fbefd473393514cf5e7874c
SHA512

b86be893441d835158642bbf955820298c592b80d2bf06fc3f503a645a1b25db85d9655a364ac271b0a4a3bb568054f4c6d54d930af7470dadc264195f48a825
SSDEEP

3072:uEyUyJubNTIuwYK7FzAOYfDftm4fy6sv8v9Kq1Aow5RVLV9uIIDcq1QQm07l+vdL:umkPkIV/7ntQm07

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow	pid	Process
8	1400	rundll32.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
1584	1400	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2868 wrote to memory of 1400	2868	rundll32.exe	80
PID 2868 wrote to memory of 1400	2868	rundll32.exe	80
PID 2868 wrote to memory of 1400	2868	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\鑫财手机协议全能王\dc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\鑫财手机协议全能王\dc.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:1400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 884
    3⤵
    - Program crash
    PID:1584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1400 -ip 1400
1⤵
PID:4796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1400-132-0x0000000000000000-mapping.dmp

Download