0123418ffeceaec339159113651a7f2bb502b64b25a34d812b27ff88e1e53db3 | Triage

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 07:18

Sharing

Report Analysis Logs

General

Target

明月11.79/CDload.dll
Size

92KB
MD5

b7b04e78799269eb6ae07242efc43c69
SHA1

e580b938475370270a5c3068669f23cf717a8c92
SHA256

086ba32e43977b507a65a78a74a15ee6f23ed961598b73e2c6997896249a46b2
SHA512

0a1ba08439e660b011135b3f3591ddfa5575261a2bd9620f8a0f3e3c041ca3667e1e0850b49c8275f6c9877cce3a53208db2338ff47fa10bf694d4a07ca7c515
SSDEEP

1536:Kj01IgN9qSsxZCMd4J9529W4dWB8zI0rfub:S/W9qPCxYdxWb

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

808 1108 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1108 rundll32.exe
1108 rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

rundll32.exe

description pid process

Token: SeDebugPrivilege 1108 rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 896 wrote to memory of 1108	896	rundll32.exe	rundll32.exe
PID 896 wrote to memory of 1108	896	rundll32.exe	rundll32.exe
PID 896 wrote to memory of 1108	896	rundll32.exe	rundll32.exe
PID 896 wrote to memory of 1108	896	rundll32.exe	rundll32.exe
PID 896 wrote to memory of 1108	896	rundll32.exe	rundll32.exe
PID 896 wrote to memory of 1108	896	rundll32.exe	rundll32.exe
PID 896 wrote to memory of 1108	896	rundll32.exe	rundll32.exe
PID 1108 wrote to memory of 808	1108	rundll32.exe	WerFault.exe
PID 1108 wrote to memory of 808	1108	rundll32.exe	WerFault.exe
PID 1108 wrote to memory of 808	1108	rundll32.exe	WerFault.exe
PID 1108 wrote to memory of 808	1108	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\明月11.79\CDload.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:896

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\明月11.79\CDload.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 232
3⤵
- Program crash
PID:808

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/808-56-0x0000000000000000-mapping.dmp

Download
memory/1108-54-0x0000000000000000-mapping.dmp

Download
memory/1108-55-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download