bf176a4b8c3cec298fe69a631aca88f9ebf3a9757d53d9ca49e1ad0bf2d8a0e9

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 04:54

Target

急速辅助免费版1223/前锋加速器1.6/com.dll
Size

264KB
MD5

c7b465f4ff7e93f394fb3400cd0f3bef
SHA1

0be1886d0b1630411c25a89308bb07b72d77ec76
SHA256

29dde1067895bd54fe78f4a262ef810a787063e0ff9ed97d059ba04e520f12ef
SHA512

436539ac8474dd3dddac81d372e52f7af181aca37d225a49c587a727d4421fb4135dd13420c1b3fa9fe84ef2d93d0ae5e37e7974dff68f078b7b69fb892dc23f
SSDEEP

6144:FUK0aR9XFLpXX74igKbaYqdVM1R/jvcDsUxGNKUHgl:eKLrNqilhKM1R/jEDsIj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1548 1004 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1548	1004	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1916 wrote to memory of 1004	1916	rundll32.exe	rundll32.exe
PID 1916 wrote to memory of 1004	1916	rundll32.exe	rundll32.exe
PID 1916 wrote to memory of 1004	1916	rundll32.exe	rundll32.exe
PID 1916 wrote to memory of 1004	1916	rundll32.exe	rundll32.exe
PID 1916 wrote to memory of 1004	1916	rundll32.exe	rundll32.exe
PID 1916 wrote to memory of 1004	1916	rundll32.exe	rundll32.exe
PID 1916 wrote to memory of 1004	1916	rundll32.exe	rundll32.exe
PID 1004 wrote to memory of 1548	1004	rundll32.exe	WerFault.exe
PID 1004 wrote to memory of 1548	1004	rundll32.exe	WerFault.exe
PID 1004 wrote to memory of 1548	1004	rundll32.exe	WerFault.exe
PID 1004 wrote to memory of 1548	1004	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\急速辅助免费版1223\前锋加速器1.6\com.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\急速辅助免费版1223\前锋加速器1.6\com.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1004 -s 260
    3⤵
    - Program crash
    PID:1548

memory/1004-54-0x0000000000000000-mapping.dmp

Download
memory/1004-55-0x0000000075211000-0x0000000075213000-memory.dmp

Filesize
8KB

Download
memory/1004-57-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download
memory/1548-56-0x0000000000000000-mapping.dmp

Download