bf176a4b8c3cec298fe69a631aca88f9ebf3a9757d53d9ca49e1ad0bf2d8a0e9 | Triage

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 04:54

Sharing

Report Analysis Logs

General

Target

急速辅助免费版1223/前锋加速器1.6/com.dll
Size

264KB
MD5

c7b465f4ff7e93f394fb3400cd0f3bef
SHA1

0be1886d0b1630411c25a89308bb07b72d77ec76
SHA256

29dde1067895bd54fe78f4a262ef810a787063e0ff9ed97d059ba04e520f12ef
SHA512

436539ac8474dd3dddac81d372e52f7af181aca37d225a49c587a727d4421fb4135dd13420c1b3fa9fe84ef2d93d0ae5e37e7974dff68f078b7b69fb892dc23f
SSDEEP

6144:FUK0aR9XFLpXX74igKbaYqdVM1R/jvcDsUxGNKUHgl:eKLrNqilhKM1R/jEDsIj

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

836 1112 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4864 wrote to memory of 1112	4864	rundll32.exe	rundll32.exe
PID 4864 wrote to memory of 1112	4864	rundll32.exe	rundll32.exe
PID 4864 wrote to memory of 1112	4864	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\急速辅助免费版1223\前锋加速器1.6\com.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\急速辅助免费版1223\前锋加速器1.6\com.dll,#1
  2⤵
  PID:1112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 648
    3⤵
    - Program crash
    PID:836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1112 -ip 1112
1⤵
PID:2824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1112-132-0x0000000000000000-mapping.dmp

Download
memory/1112-133-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download