Overview
overview
9Static
static
9幻想辅助3/DM.dll
windows7-x64
1幻想辅助3/DM.dll
windows10-2004-x64
8幻想辅�...ad.dll
windows7-x64
1幻想辅�...ad.dll
windows10-2004-x64
1幻想辅助3/San.dll
windows7-x64
5幻想辅助3/San.dll
windows10-2004-x64
5幻想辅助3/com.dll
windows7-x64
3幻想辅助3/com.dll
windows10-2004-x64
3幻想辅�...30.exe
windows7-x64
1幻想辅�...30.exe
windows10-2004-x64
3幻想辅�...01.exe
windows7-x64
1幻想辅�...01.exe
windows10-2004-x64
3幻想辅�...��.exe
windows7-x64
1幻想辅�...��.exe
windows10-2004-x64
3幻想辅�...��.exe
windows7-x64
1幻想辅�...��.exe
windows10-2004-x64
3幻想辅�...��.exe
windows7-x64
1幻想辅�...��.exe
windows10-2004-x64
3幻想辅�...ln.dll
windows7-x64
1幻想辅�...ln.dll
windows10-2004-x64
1幻想辅�...ec.dll
windows7-x64
1幻想辅�...ec.dll
windows10-2004-x64
1幻想辅�...��.exe
windows7-x64
8幻想辅�...��.exe
windows10-2004-x64
3最新QQ�...��.url
windows7-x64
1最新QQ�...��.url
windows10-2004-x64
1Analysis
-
max time kernel
154s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 19:23
Behavioral task
behavioral1
Sample
幻想辅助3/DM.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
幻想辅助3/DM.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
幻想辅助3/EThread.dll
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
幻想辅助3/EThread.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
幻想辅助3/San.dll
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
幻想辅助3/San.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
幻想辅助3/com.dll
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
幻想辅助3/com.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
幻想辅助3/ds30.exe
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
幻想辅助3/ds30.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
幻想辅助3/ds301.exe
Resource
win7-20220901-en
Behavioral task
behavioral12
Sample
幻想辅助3/ds301.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
幻想辅助3/ds30试用版.exe
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
幻想辅助3/ds30试用版.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
幻想辅助3/ds30试用版(笔记本小屏幕用).exe
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
幻想辅助3/ds30试用版(笔记本小屏幕用).exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
幻想辅助3/ds30(笔记本小屏幕用).exe
Resource
win7-20221111-en
Behavioral task
behavioral18
Sample
幻想辅助3/ds30(笔记本小屏幕用).exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
幻想辅助3/krnln.dll
Resource
win7-20221111-en
Behavioral task
behavioral20
Sample
幻想辅助3/krnln.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral21
Sample
幻想辅助3/spec.dll
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
幻想辅助3/spec.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral23
Sample
幻想辅助3/小菜破戒.exe
Resource
win7-20220901-en
Behavioral task
behavioral24
Sample
幻想辅助3/小菜破戒.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
最新QQ软件下载.url
Resource
win7-20220812-en
Behavioral task
behavioral26
Sample
最新QQ软件下载.url
Resource
win10v2004-20221111-en
General
-
Target
幻想辅助3/com.dll
-
Size
260KB
-
MD5
a50997b4c89c65c884962b7329f79482
-
SHA1
0682991c12e6291e4cda784f9bcec9d94e929f99
-
SHA256
ecff85bf05907c9806b66c8a18e21dbf689ed28c5fba9c5e3dc8a38a51d9c5de
-
SHA512
273339549636c12b0faa634be1eaee78ef504df35014d7c82ac979eea4bde8a3d69f3b232dc49e8f3ccafa0a72edaf576a9d69ea031681d6a9ed9a5e0bfde9ab
-
SSDEEP
3072:oE3SIWawqQX1yfkL7CfDyiOUAVvzUT3F4a3OMn08Mm/5zIuBEgWo0iM//Ke6N:A1nLO7PAhzUx4agasH//
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 444 1152 WerFault.exe 78 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3376 wrote to memory of 1152 3376 rundll32.exe 78 PID 3376 wrote to memory of 1152 3376 rundll32.exe 78 PID 3376 wrote to memory of 1152 3376 rundll32.exe 78
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\幻想辅助3\com.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\幻想辅助3\com.dll,#12⤵PID:1152
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 6603⤵
- Program crash
PID:444
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1152 -ip 11521⤵PID:4360