56c46d532f0c3e73c64d73cf15f89500d50e9142b8a91cf940432f2fb27d6065

Analysis

max time kernel
250s
max time network
400s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 06:12

Target

三国魂战魂/unrar.dll
Size

81KB
MD5

5ffcd122278699aadf24308c843fa969
SHA1

f9ddd27acfd3df56d1d1de6577f2bf2db71e475e
SHA256

c5b9b208bc010e97d40dcce59d6375ce91aa5b754e5623d99091f30382b3f811
SHA512

56f200113db4cdabc71e517e50d3358eba1047a64c71bc4c2c69351c11ffb79a3a2d890f6c4034cd608bd06105db7c01cf2e0d55a47b39942b72553ff90b23b0
SSDEEP

1536:Fj2/RqGwe/iJdmPcy7tLc2TP50c7r/ULcj8uLw6iBmsxl+rMIzsLdtQUEm1G7h:FjkKe/iJdmPNJTT7/8ludiZcZzsZyUEv

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

916 1080 WerFault.exe rundll32.exe

pid	pid_target	process	target process
916	1080	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1000 wrote to memory of 1080	1000	rundll32.exe	rundll32.exe
PID 1000 wrote to memory of 1080	1000	rundll32.exe	rundll32.exe
PID 1000 wrote to memory of 1080	1000	rundll32.exe	rundll32.exe
PID 1000 wrote to memory of 1080	1000	rundll32.exe	rundll32.exe
PID 1000 wrote to memory of 1080	1000	rundll32.exe	rundll32.exe
PID 1000 wrote to memory of 1080	1000	rundll32.exe	rundll32.exe
PID 1000 wrote to memory of 1080	1000	rundll32.exe	rundll32.exe
PID 1080 wrote to memory of 916	1080	rundll32.exe	WerFault.exe
PID 1080 wrote to memory of 916	1080	rundll32.exe	WerFault.exe
PID 1080 wrote to memory of 916	1080	rundll32.exe	WerFault.exe
PID 1080 wrote to memory of 916	1080	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\三国魂战魂\unrar.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1000

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\三国魂战魂\unrar.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 224
3⤵
- Program crash
PID:916

memory/916-59-0x0000000000000000-mapping.dmp

Download
memory/1080-54-0x0000000000000000-mapping.dmp

Download
memory/1080-55-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/1080-56-0x0000000074C40000-0x0000000074C8E000-memory.dmp

Filesize
312KB

Download
memory/1080-57-0x0000000074C40000-0x0000000074C8E000-memory.dmp

Filesize
312KB

Download
memory/1080-58-0x0000000074C90000-0x0000000074CDE000-memory.dmp

Filesize
312KB

Download
memory/1080-61-0x0000000074C90000-0x0000000074CDE000-memory.dmp

Filesize
312KB

Download
memory/1080-60-0x0000000074C90000-0x0000000074CDE000-memory.dmp

Filesize
312KB

Download