41bbbe806b787ebbd8f8ac5f813a00ed4b822e500ecacabcd3ff94ff21e06c24 | Triage

Analysis

max time kernel
92s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 01:39

Sharing

Report Analysis Logs

General

Target

DPlayer_lv/QtXml4.dll
Size

347KB
MD5

662b511776db4e9fb59d740cd2d18d28
SHA1

699aa8e02b605d7f74248668434e8fdc7997c5b2
SHA256

0c875b667cb90952aa628ae713644b0bbf2413aa3cfa310f8dfdabab1990e06e
SHA512

7c0f7cc3f0ee70e5682c01bb4a234d4f036fc10443d8e63605083a0528e1326a8f96bade2e4b95288a2e07e5f5f63c02f8eb44a23aee4c0d16db4380626d68d9
SSDEEP

6144:akwkS0wEgT8UQzveVai1FT7AFJvWOHSMObx8JK:akwkLwLT8BeVFfAFvs

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
432	788	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	Process	procid_target
PID 828 wrote to memory of 788	828	rundll32.exe	28
PID 828 wrote to memory of 788	828	rundll32.exe	28
PID 828 wrote to memory of 788	828	rundll32.exe	28
PID 828 wrote to memory of 788	828	rundll32.exe	28
PID 828 wrote to memory of 788	828	rundll32.exe	28
PID 828 wrote to memory of 788	828	rundll32.exe	28
PID 828 wrote to memory of 788	828	rundll32.exe	28
PID 788 wrote to memory of 432	788	rundll32.exe	29
PID 788 wrote to memory of 432	788	rundll32.exe	29
PID 788 wrote to memory of 432	788	rundll32.exe	29
PID 788 wrote to memory of 432	788	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DPlayer_lv\QtXml4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DPlayer_lv\QtXml4.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 228
    3⤵
    - Program crash
    PID:432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/432-56-0x0000000000000000-mapping.dmp

Download
memory/788-54-0x0000000000000000-mapping.dmp

Download
memory/788-55-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download