bf176a4b8c3cec298fe69a631aca88f9ebf3a9757d53d9ca49e1ad0bf2d8a0e9 | Triage

Analysis

max time kernel
158s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 04:54

Sharing

Report Analysis Logs

General

Target

急速辅助免费版1223/前锋加速器1.6/dp1.dll
Size

128KB
MD5

b544ea96eddae14a8ac08fe8fea929eb
SHA1

a63bae9ff58b3756d28d6931f2187f5057582215
SHA256

633a6bda627c57749a4e64d09132ec3c5b564e00f9c67a71fda3fd4e13aa8dd7
SHA512

364ed87d7a935fc62b1bffa867ea7398bcb3d6909409d48acd24600d760f49dc09248cb91aae7a46f6d097ed3ccdb7611979ac560530b56319880a4d5ab5896f
SSDEEP

3072:DwyNJvFRwjQMiQcEs+4bnq2oJyG3oJyRk16XNR:kyffrMCEsbnqtyKRk1m

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3860 3932 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1476 wrote to memory of 3932	1476	rundll32.exe	rundll32.exe
PID 1476 wrote to memory of 3932	1476	rundll32.exe	rundll32.exe
PID 1476 wrote to memory of 3932	1476	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\急速辅助免费版1223\前锋加速器1.6\dp1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1476

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\急速辅助免费版1223\前锋加速器1.6\dp1.dll,#1
2⤵
PID:3932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 600
3⤵
- Program crash
PID:3860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3932 -ip 3932
1⤵
PID:4260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3932-132-0x0000000000000000-mapping.dmp

Download
memory/3932-133-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download