a0dcf63ff683243a2dd902ce32c6b9c607e953be27d7cdf056a1ef777015d1b8

Analysis

max time kernel
39s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 05:16

Target

急速辅助免费版1120/前锋加速器/com.dll
Size

260KB
MD5

a50997b4c89c65c884962b7329f79482
SHA1

0682991c12e6291e4cda784f9bcec9d94e929f99
SHA256

ecff85bf05907c9806b66c8a18e21dbf689ed28c5fba9c5e3dc8a38a51d9c5de
SHA512

273339549636c12b0faa634be1eaee78ef504df35014d7c82ac979eea4bde8a3d69f3b232dc49e8f3ccafa0a72edaf576a9d69ea031681d6a9ed9a5e0bfde9ab
SSDEEP

3072:oE3SIWawqQX1yfkL7CfDyiOUAVvzUT3F4a3OMn08Mm/5zIuBEgWo0iM//Ke6N:A1nLO7PAhzUx4agasH//

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

856 1780 WerFault.exe rundll32.exe

pid	pid_target	process	target process
856	1780	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1088 wrote to memory of 1780	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 1780	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 1780	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 1780	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 1780	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 1780	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 1780	1088	rundll32.exe	rundll32.exe
PID 1780 wrote to memory of 856	1780	rundll32.exe	WerFault.exe
PID 1780 wrote to memory of 856	1780	rundll32.exe	WerFault.exe
PID 1780 wrote to memory of 856	1780	rundll32.exe	WerFault.exe
PID 1780 wrote to memory of 856	1780	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\急速辅助免费版1120\前锋加速器\com.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\急速辅助免费版1120\前锋加速器\com.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 260
    3⤵
    - Program crash
    PID:856

memory/856-56-0x0000000000000000-mapping.dmp

Download
memory/1780-54-0x0000000000000000-mapping.dmp

Download
memory/1780-55-0x0000000074D61000-0x0000000074D63000-memory.dmp

Filesize
8KB

Download