49842b1e71ab037e48a822336cedde220b93e3fca667b7bd7c8cc9ec5489e49e | Triage

Analysis

max time kernel
160s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 19:23

Sharing

Report Analysis Logs

General

Target

幻想辅助3/小菜破戒.exe
Size

760KB
MD5

edc7cfb7aef1925d7ece62ad826a035d
SHA1

7d11d5860bb9b9817b7e170f0a31614e132994ac
SHA256

dedea129a4d3bbd3a543f0b83e8e5cce7f38d10e3d6ec2a29de902a924af545c
SHA512

5f86de5528fa4a51c5f5151932da2d387ffbf3ea350829ef33cbc38d4700fe99b5b6c3b96b7e7a94fc2467ced96737d2e9a74e8802c89467ec69f554ff730601
SSDEEP

12288:oMC1HSAwx2if8mFgUxIX1kfzw+ryCI+DR5nWFpPoSLq:oTox2tVUaX6fzJr17ybU

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2888	3724	WerFault.exe	78

C:\Users\Admin\AppData\Local\Temp\幻想辅助3\小菜破戒.exe
"C:\Users\Admin\AppData\Local\Temp\幻想辅助3\小菜破戒.exe"
1⤵
PID:3724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3724 -s 528
  2⤵
  - Program crash
  PID:2888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3724 -ip 3724
1⤵
PID:1604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3724-132-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download