56c46d532f0c3e73c64d73cf15f89500d50e9142b8a91cf940432f2fb27d6065

Analysis

max time kernel
142s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 06:12

Target

三国魂战魂/unrar.dll
Size

81KB
MD5

5ffcd122278699aadf24308c843fa969
SHA1

f9ddd27acfd3df56d1d1de6577f2bf2db71e475e
SHA256

c5b9b208bc010e97d40dcce59d6375ce91aa5b754e5623d99091f30382b3f811
SHA512

56f200113db4cdabc71e517e50d3358eba1047a64c71bc4c2c69351c11ffb79a3a2d890f6c4034cd608bd06105db7c01cf2e0d55a47b39942b72553ff90b23b0
SSDEEP

1536:Fj2/RqGwe/iJdmPcy7tLc2TP50c7r/ULcj8uLw6iBmsxl+rMIzsLdtQUEm1G7h:FjkKe/iJdmPNJTT7/8ludiZcZzsZyUEv

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4588 1424 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4588	1424	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5084 wrote to memory of 1424	5084	rundll32.exe	rundll32.exe
PID 5084 wrote to memory of 1424	5084	rundll32.exe	rundll32.exe
PID 5084 wrote to memory of 1424	5084	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\三国魂战魂\unrar.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\三国魂战魂\unrar.dll,#1
  2⤵
  PID:1424
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 612
    3⤵
    - Program crash
    PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1424 -ip 1424
1⤵
PID:3472

memory/1424-133-0x0000000000000000-mapping.dmp

Download
memory/1424-134-0x0000000074FE0000-0x000000007502E000-memory.dmp

Filesize
312KB

Download
memory/1424-135-0x0000000074FE0000-0x000000007502E000-memory.dmp

Filesize
312KB

Download