27784f24a8d0b693b96e57355c6eab3e56f2b6909cf74154393fdb6ee9ac6d17

Analysis

max time kernel
16s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 18:37

Target

冰封免费版(请关闭杀毒软件下载)/Astar.dll
Size

35KB
MD5

c0b716b0a39e6bd5b97ad509c59616cd
SHA1

434b02800a9b19e17901eb7c46c6ca240bc573de
SHA256

e791c2fa9b0435ade26b7d8d295ac957ce0eb5d30bca0cbc4cff3d3f5d8dbdef
SHA512

60bbfa1d09ff9fc5aa25886d22cc9c4bd4b602e4a723a5f3ea454cf3834a8dabf8d8630dbc8f6a61765d3feb7d498526e19503db27fbb6350266d2ea40cb17cb
SSDEEP

384:voWyKa2k8KeTduFoSQPZaqSItpQt/stcc/pjKhwElrP+lnu6EDHkCr1GNC8vyNbn:v+KWVKFazapm70+hf7GnTEDT8vyh

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1616 1400 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1616	1400	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1948 wrote to memory of 1400	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 1400	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 1400	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 1400	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 1400	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 1400	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 1400	1948	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 1616	1400	rundll32.exe	WerFault.exe
PID 1400 wrote to memory of 1616	1400	rundll32.exe	WerFault.exe
PID 1400 wrote to memory of 1616	1400	rundll32.exe	WerFault.exe
PID 1400 wrote to memory of 1616	1400	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\冰封免费版(请关闭杀毒软件下载)\Astar.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\冰封免费版(请关闭杀毒软件下载)\Astar.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 224
    3⤵
    - Program crash
    PID:1616

memory/1400-54-0x0000000000000000-mapping.dmp

Download
memory/1400-55-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1616-56-0x0000000000000000-mapping.dmp

Download