6d4c10c35d912c28e341479228551e1f175730f7233da8ae223f65534a204951

Analysis

max time kernel
168s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 06:05

Target

三国魂战魂/unrar.dll
Size

81KB
MD5

5ffcd122278699aadf24308c843fa969
SHA1

f9ddd27acfd3df56d1d1de6577f2bf2db71e475e
SHA256

c5b9b208bc010e97d40dcce59d6375ce91aa5b754e5623d99091f30382b3f811
SHA512

56f200113db4cdabc71e517e50d3358eba1047a64c71bc4c2c69351c11ffb79a3a2d890f6c4034cd608bd06105db7c01cf2e0d55a47b39942b72553ff90b23b0
SSDEEP

1536:Fj2/RqGwe/iJdmPcy7tLc2TP50c7r/ULcj8uLw6iBmsxl+rMIzsLdtQUEm1G7h:FjkKe/iJdmPNJTT7/8ludiZcZzsZyUEv

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

624 960 WerFault.exe rundll32.exe

pid	pid_target	process	target process
624	960	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3336 wrote to memory of 960	3336	rundll32.exe	rundll32.exe
PID 3336 wrote to memory of 960	3336	rundll32.exe	rundll32.exe
PID 3336 wrote to memory of 960	3336	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\三国魂战魂\unrar.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\三国魂战魂\unrar.dll,#1
  2⤵
  PID:960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 612
    3⤵
    - Program crash
    PID:624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 960 -ip 960
1⤵
PID:1612

memory/960-132-0x0000000000000000-mapping.dmp

Download
memory/960-133-0x0000000075850000-0x000000007589E000-memory.dmp

Filesize
312KB

Download
memory/960-134-0x0000000075850000-0x000000007589E000-memory.dmp

Filesize
312KB

Download