27784f24a8d0b693b96e57355c6eab3e56f2b6909cf74154393fdb6ee9ac6d17

Analysis

max time kernel
111s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 18:37

Target

冰封免费版(请关闭杀毒软件下载)/GetInfo.dll
Size

1.5MB
MD5

dbac2c9c7545463a542820337e504dd4
SHA1

f1927a37103145678bffefd2437d3c18a9b68831
SHA256

ef022b706eab8542d2cf3be7de64b66cb809509732b08f6e055abeb84bdbba48
SHA512

298dca7f6a9b9557305d435463063b421285d2420f581f28770ffb837dee55ae7ab99547bbd5e4d80da7958d1eb259f0d3c8262bbbd71517d89a0de47795d384
SSDEEP

49152:7wZEkRqxYYYGkMzgBss/g6hIOd9uZNMcC8CFyluyplN1vn:QEnxdHkMz8ss/g6hISuzvCFysyplN

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

788 5044 WerFault.exe rundll32.exe

pid	pid_target	process	target process
788	5044	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2776 wrote to memory of 5044	2776	rundll32.exe	rundll32.exe
PID 2776 wrote to memory of 5044	2776	rundll32.exe	rundll32.exe
PID 2776 wrote to memory of 5044	2776	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\冰封免费版(请关闭杀毒软件下载)\GetInfo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\冰封免费版(请关闭杀毒软件下载)\GetInfo.dll,#1
  2⤵
  PID:5044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 676
    3⤵
    - Program crash
    PID:788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5044 -ip 5044
1⤵
PID:5032