41bbbe806b787ebbd8f8ac5f813a00ed4b822e500ecacabcd3ff94ff21e06c24 | Triage

Analysis

max time kernel
204s
max time network
267s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 01:39

Sharing

Report Analysis Logs

General

Target

DPlayer_lv/QtXml4.dll
Size

347KB
MD5

662b511776db4e9fb59d740cd2d18d28
SHA1

699aa8e02b605d7f74248668434e8fdc7997c5b2
SHA256

0c875b667cb90952aa628ae713644b0bbf2413aa3cfa310f8dfdabab1990e06e
SHA512

7c0f7cc3f0ee70e5682c01bb4a234d4f036fc10443d8e63605083a0528e1326a8f96bade2e4b95288a2e07e5f5f63c02f8eb44a23aee4c0d16db4380626d68d9
SSDEEP

6144:akwkS0wEgT8UQzveVai1FT7AFJvWOHSMObx8JK:akwkLwLT8BeVFfAFvs

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
4220	1012	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 4684 wrote to memory of 1012	4684	rundll32.exe	81
PID 4684 wrote to memory of 1012	4684	rundll32.exe	81
PID 4684 wrote to memory of 1012	4684	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DPlayer_lv\QtXml4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DPlayer_lv\QtXml4.dll,#1
  2⤵
  PID:1012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 648
    3⤵
    - Program crash
    PID:4220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1012 -ip 1012
1⤵
PID:4468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1012-132-0x0000000000000000-mapping.dmp

Download