49842b1e71ab037e48a822336cedde220b93e3fca667b7bd7c8cc9ec5489e49e | Triage

Analysis

max time kernel
172s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 19:23

Sharing

Report Analysis Logs

General

Target

幻想辅助3/ds30试用版（笔记本小屏幕用）.exe
Size

70KB
MD5

cc886ac7b9ca389cc5ad438b71968055
SHA1

0ba244e6b24b7f4a1775da5ce062c25c205ca9a8
SHA256

87062f6a1b2dd83cd25e71fb9c40c178331cf35d1c4b31d799c2adcd36ae051e
SHA512

964307456ec82608a4c73d2caf2db21bb17ca956acc0001cd5664c180ebaee696f511de2e8f0a4ed467da06833cb09269c7b27385dc9cc8d99f97368544a47a7
SSDEEP

1536:hix4GTf3cAiUz13Wp9626ApvrlVJ4E5s:y4sciz1392rDd4Ms

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3812	5008	WerFault.exe	78

C:\Users\Admin\AppData\Local\Temp\幻想辅助3\ds30试用版（笔记本小屏幕用）.exe
"C:\Users\Admin\AppData\Local\Temp\幻想辅助3\ds30试用版（笔记本小屏幕用）.exe"
1⤵
PID:5008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 660
  2⤵
  - Program crash
  PID:3812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5008 -ip 5008
1⤵
PID:4624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5008-132-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/5008-133-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download