80a1fd1ece493f72a864f3e60d1ea43e503b27a11a9d18234ec398337c574aaa

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 05:47

Target

QQռ˵˵ɾ/dp1.dll
Size

128KB
MD5

f9e1cbaaf889f0a440d43f1efc42a310
SHA1

07927506f5dff52509ad431aeb27b25fe06bdc0c
SHA256

9ade37d9bfe5cd302ac440e9c68f9f67408263237287ffb6b56ca796ac1cb9ce
SHA512

7ede805de6fa057bd74fc6711c56bfa5bca2f6a89185a90732fa10072d403b099ec15a3cb1ce8a6227cd6c3a9ba3165e3708f5e67443478fd593bec6fcc652f8
SSDEEP

3072:reaEHUzyzneUPCi4Nfef0EnYw7EG3oR5NO:rXazeUPCicefJnYw4JNO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1220	1076	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 1076	864	rundll32.exe	27
PID 864 wrote to memory of 1076	864	rundll32.exe	27
PID 864 wrote to memory of 1076	864	rundll32.exe	27
PID 864 wrote to memory of 1076	864	rundll32.exe	27
PID 864 wrote to memory of 1076	864	rundll32.exe	27
PID 864 wrote to memory of 1076	864	rundll32.exe	27
PID 864 wrote to memory of 1076	864	rundll32.exe	27
PID 1076 wrote to memory of 1220	1076	rundll32.exe	28
PID 1076 wrote to memory of 1220	1076	rundll32.exe	28
PID 1076 wrote to memory of 1220	1076	rundll32.exe	28
PID 1076 wrote to memory of 1220	1076	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQռ˵˵ɾ\dp1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQռ˵˵ɾ\dp1.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1076 -s 228
    3⤵
    - Program crash
    PID:1220

memory/1076-54-0x0000000000000000-mapping.dmp

Download
memory/1076-55-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download
memory/1076-57-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download
memory/1220-56-0x0000000000000000-mapping.dmp

Download