Analysis
-
max time kernel
136s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
27/11/2022, 07:12
General
-
Target
TheWorldPortable/Application/6.2.0.128/plugins/npUploader.dll
-
Size
575KB
-
MD5
3def8fa5ffbce5f52a0c8d9cc7524418
-
SHA1
47a4163f11d4ee18faa2fa0946bc396c9edddb12
-
SHA256
628995f8d697505139e3822e927f0c50a142bd89272631e27e86b35807379e7b
-
SHA512
965d35aeed75d840f7556a041e251ef818c4598edb78be5a965fa625bbb008da4b7e6425bd21305a068b7a730a1012d8b25dc4c3c415ef613ec5df6321769e9c
-
SSDEEP
12288:xV9oBX5b+RyhGkeXBvOwVUjBGkYzQUEEy4mor3ueTrJMYf:xV9A5uWdWZmorvTrB
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\TheWorldPortable\Application\6.2.0.128\plugins\npUploader.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\TheWorldPortable\Application\6.2.0.128\plugins\npUploader.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 6603⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1812 -ip 18121⤵