1284396c6f7a5d88d4d3eddfe28d751c54fa8763554c669e83c05d927702b053

Analysis

max time kernel
91s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 06:57

Target

QQ群批量拉人软件2.1/UUWisehelper.dll
Size

118KB
MD5

2725e51ac1906b999c81319aa4cb0c45
SHA1

babe7f11c5af056a0a569c1a982478ac698aea6c
SHA256

0aa6ca66a683b6e8baf78f2d5e91a016e3a6fb5470d42080d39ca43c03f2f3ba
SHA512

2af4679579dc077977060c4ca2ec1f562affb2492e8b4f2dd965948090c105b49d93ecee28374c2fc1a29df00a090c223b1e424841ec702d256923c42bb0a1dc
SSDEEP

1536:czR/k08QIGChujtNVEmFKg9v4ReW92eX80OjvI/eKB4njUS5Dc1L:cl/k08fG0cK0BUBygdBjS5Dc1

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2724 384 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2724	384	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4956 wrote to memory of 384	4956	rundll32.exe	rundll32.exe
PID 4956 wrote to memory of 384	4956	rundll32.exe	rundll32.exe
PID 4956 wrote to memory of 384	4956	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQ群批量拉人软件2.1\UUWisehelper.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4956

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQ群批量拉人软件2.1\UUWisehelper.dll,#1
2⤵
PID:384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 384 -s 672
3⤵
- Program crash
PID:2724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 384 -ip 384
1⤵
PID:4828