6d4c10c35d912c28e341479228551e1f175730f7233da8ae223f65534a204951

Analysis

max time kernel
64s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 06:05

Target

三国魂战魂/unrar.dll
Size

81KB
MD5

5ffcd122278699aadf24308c843fa969
SHA1

f9ddd27acfd3df56d1d1de6577f2bf2db71e475e
SHA256

c5b9b208bc010e97d40dcce59d6375ce91aa5b754e5623d99091f30382b3f811
SHA512

56f200113db4cdabc71e517e50d3358eba1047a64c71bc4c2c69351c11ffb79a3a2d890f6c4034cd608bd06105db7c01cf2e0d55a47b39942b72553ff90b23b0
SSDEEP

1536:Fj2/RqGwe/iJdmPcy7tLc2TP50c7r/ULcj8uLw6iBmsxl+rMIzsLdtQUEm1G7h:FjkKe/iJdmPNJTT7/8ludiZcZzsZyUEv

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1128 944 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1128	944	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 980 wrote to memory of 944	980	rundll32.exe	rundll32.exe
PID 980 wrote to memory of 944	980	rundll32.exe	rundll32.exe
PID 980 wrote to memory of 944	980	rundll32.exe	rundll32.exe
PID 980 wrote to memory of 944	980	rundll32.exe	rundll32.exe
PID 980 wrote to memory of 944	980	rundll32.exe	rundll32.exe
PID 980 wrote to memory of 944	980	rundll32.exe	rundll32.exe
PID 980 wrote to memory of 944	980	rundll32.exe	rundll32.exe
PID 944 wrote to memory of 1128	944	rundll32.exe	WerFault.exe
PID 944 wrote to memory of 1128	944	rundll32.exe	WerFault.exe
PID 944 wrote to memory of 1128	944	rundll32.exe	WerFault.exe
PID 944 wrote to memory of 1128	944	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\三国魂战魂\unrar.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\三国魂战魂\unrar.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 944 -s 224
    3⤵
    - Program crash
    PID:1128

memory/944-54-0x0000000000000000-mapping.dmp

Download
memory/944-55-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

Filesize
8KB

Download
memory/944-56-0x0000000074C40000-0x0000000074C8E000-memory.dmp

Filesize
312KB

Download
memory/944-57-0x0000000074C40000-0x0000000074C8E000-memory.dmp

Filesize
312KB

Download
memory/944-58-0x0000000074C90000-0x0000000074CDE000-memory.dmp

Filesize
312KB

Download
memory/944-60-0x0000000074C90000-0x0000000074CDE000-memory.dmp

Filesize
312KB

Download
memory/1128-59-0x0000000000000000-mapping.dmp

Download