bf176a4b8c3cec298fe69a631aca88f9ebf3a9757d53d9ca49e1ad0bf2d8a0e9 | Triage

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 04:54

Sharing

Report Analysis Logs

General

Target

急速辅助免费版1223/前锋加速器1.6/dp1.dll
Size

128KB
MD5

b544ea96eddae14a8ac08fe8fea929eb
SHA1

a63bae9ff58b3756d28d6931f2187f5057582215
SHA256

633a6bda627c57749a4e64d09132ec3c5b564e00f9c67a71fda3fd4e13aa8dd7
SHA512

364ed87d7a935fc62b1bffa867ea7398bcb3d6909409d48acd24600d760f49dc09248cb91aae7a46f6d097ed3ccdb7611979ac560530b56319880a4d5ab5896f
SSDEEP

3072:DwyNJvFRwjQMiQcEs+4bnq2oJyG3oJyRk16XNR:kyffrMCEsbnqtyKRk1m

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1900 1972 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1980 wrote to memory of 1972	1980	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 1972	1980	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 1972	1980	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 1972	1980	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 1972	1980	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 1972	1980	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 1972	1980	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 1900	1972	rundll32.exe	WerFault.exe
PID 1972 wrote to memory of 1900	1972	rundll32.exe	WerFault.exe
PID 1972 wrote to memory of 1900	1972	rundll32.exe	WerFault.exe
PID 1972 wrote to memory of 1900	1972	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\急速辅助免费版1223\前锋加速器1.6\dp1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1980

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\急速辅助免费版1223\前锋加速器1.6\dp1.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 228
3⤵
- Program crash
PID:1900

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1900-56-0x0000000000000000-mapping.dmp

Download
memory/1972-54-0x0000000000000000-mapping.dmp

Download
memory/1972-55-0x0000000075981000-0x0000000075983000-memory.dmp

Filesize
8KB

Download
memory/1972-57-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download