Analysis
-
max time kernel
174s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
27/11/2022, 07:12
General
-
Target
TheWorldPortable/Application/6.2.0.128/plugins/npxunlei.dll
-
Size
82KB
-
MD5
d29e9605cef7944c4d0245fa9d830a14
-
SHA1
8068c097f39af3deb4847156a4baf4ab9e069704
-
SHA256
081a38592fd50f6e9f4e84ee6de25d6a09041a972ecf7c8f7309eacce577b0bb
-
SHA512
28ded92da44329bc197952e673631c1ead1198514dd7386c31c1e1be26596c808bf0648ef1e2690353c1a02e21e1fc33f1b719c59f10810183911a5cb7ad7803
-
SSDEEP
1536:/UFSIgkQvIGKIimVJ5QSlxhwo3zKOlrQ87qh:/UkIgLbUmV+oKOlrl7qh
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\TheWorldPortable\Application\6.2.0.128\plugins\npxunlei.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\TheWorldPortable\Application\6.2.0.128\plugins\npxunlei.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4500 -s 6123⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4500 -ip 45001⤵