bced812112439dc85b04747045a0a19ee4b6d9f9ca0b378390e41379ffdb9f9d | Triage

Analysis

max time kernel
292s
max time network
296s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2023, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

PvZ_Tools_v2.7.3/libcrypto-1_1.dll
Size

1.8MB
MD5

f821ea60a784956f522901cdd966476b
SHA1

c18507e50036c17356f5c360bbc03f197c42245c
SHA256

3f42e0b958ebefec7e8a8a7f3f498c8645e1424d0dc46e62fbbacd339294b4a4
SHA512

7fa3bf55664ff3f65b38ec7274449542b9db7292a3cc89353b84fd29663186766030c35665f995cba57bb7dd94473cb4fcf10d39bbb8f8ff79142c8aaf4dba63
SSDEEP

49152:xTUdhNF2pADrWdK4tv+E8211CPwDv3uFfJPy:1UdhNF2AMQE8W1CPwDv3uFfJ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2452	780	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 780	1300	rundll32.exe	86
PID 1300 wrote to memory of 780	1300	rundll32.exe	86
PID 1300 wrote to memory of 780	1300	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.3\libcrypto-1_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.3\libcrypto-1_1.dll,#1
  2⤵
  PID:780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 628
    3⤵
    - Program crash
    PID:2452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 780 -ip 780
1⤵
PID:1360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads