49842b1e71ab037e48a822336cedde220b93e3fca667b7bd7c8cc9ec5489e49e | Triage

Analysis

max time kernel
154s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 19:23

Sharing

Report Analysis Logs

General

Target

幻想辅助3/com.dll
Size

260KB
MD5

a50997b4c89c65c884962b7329f79482
SHA1

0682991c12e6291e4cda784f9bcec9d94e929f99
SHA256

ecff85bf05907c9806b66c8a18e21dbf689ed28c5fba9c5e3dc8a38a51d9c5de
SHA512

273339549636c12b0faa634be1eaee78ef504df35014d7c82ac979eea4bde8a3d69f3b232dc49e8f3ccafa0a72edaf576a9d69ea031681d6a9ed9a5e0bfde9ab
SSDEEP

3072:oE3SIWawqQX1yfkL7CfDyiOUAVvzUT3F4a3OMn08Mm/5zIuBEgWo0iM//Ke6N:A1nLO7PAhzUx4agasH//

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
444	1152	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3376 wrote to memory of 1152	3376	rundll32.exe	78
PID 3376 wrote to memory of 1152	3376	rundll32.exe	78
PID 3376 wrote to memory of 1152	3376	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\幻想辅助3\com.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\幻想辅助3\com.dll,#1
  2⤵
  PID:1152
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 660
    3⤵
    - Program crash
    PID:444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1152 -ip 1152
1⤵
PID:4360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads