80a1fd1ece493f72a864f3e60d1ea43e503b27a11a9d18234ec398337c574aaa | Triage

Analysis

max time kernel
151s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 05:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

QQռ˵˵ɾ/dp1.dll
Size

128KB
MD5

f9e1cbaaf889f0a440d43f1efc42a310
SHA1

07927506f5dff52509ad431aeb27b25fe06bdc0c
SHA256

9ade37d9bfe5cd302ac440e9c68f9f67408263237287ffb6b56ca796ac1cb9ce
SHA512

7ede805de6fa057bd74fc6711c56bfa5bca2f6a89185a90732fa10072d403b099ec15a3cb1ce8a6227cd6c3a9ba3165e3708f5e67443478fd593bec6fcc652f8
SSDEEP

3072:reaEHUzyzneUPCi4Nfef0EnYw7EG3oR5NO:rXazeUPCicefJnYw4JNO

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3276	4452	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 4452	4728	rundll32.exe	83
PID 4728 wrote to memory of 4452	4728	rundll32.exe	83
PID 4728 wrote to memory of 4452	4728	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQռ˵˵ɾ\dp1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQռ˵˵ɾ\dp1.dll,#1
  2⤵
  PID:4452
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 600
    3⤵
    - Program crash
    PID:3276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4452 -ip 4452
1⤵
PID:1172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4452-133-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download