27784f24a8d0b693b96e57355c6eab3e56f2b6909cf74154393fdb6ee9ac6d17 | Triage

Analysis

max time kernel
144s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 18:37

Sharing

Report Analysis Logs

General

Target

冰封免费版(请关闭杀毒软件下载)/Lua.dll
Size

156KB
MD5

546696fc01d9c7c912da33a7ffecf21a
SHA1

46f3ac49346afd4e85db46ade697f536afd8bee6
SHA256

1b233ec23eccf5cc532e9f1349093ad7dc6b5d14973b1fb09251a21bf080e687
SHA512

7ac984e2d3e91a23a256c6e118d2e83c5049310e5877b436f65a82b4c0e744677ef12d945625eac72f210ad73617133dc10a64b23aa03fcc9513906167174089
SSDEEP

3072:kWxO4AOqXKN18lz1ajwgFxgi9bHb/fERierQ:kH/O+NlYBFxbnERVQ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1476 4968 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4440 wrote to memory of 4968	4440	rundll32.exe	rundll32.exe
PID 4440 wrote to memory of 4968	4440	rundll32.exe	rundll32.exe
PID 4440 wrote to memory of 4968	4440	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\冰封免费版(请关闭杀毒软件下载)\Lua.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\冰封免费版(请关闭杀毒软件下载)\Lua.dll,#1
  2⤵
  PID:4968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 600
    3⤵
    - Program crash
    PID:1476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4968 -ip 4968
1⤵
PID:4832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4968-132-0x0000000000000000-mapping.dmp

Download