bced812112439dc85b04747045a0a19ee4b6d9f9ca0b378390e41379ffdb9f9d | Triage

Analysis

max time kernel
292s
max time network
296s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2023 12:11

Sharing

Report Analysis Logs

General

Target

PvZ_Tools_v2.7.3/libcrypto-1_1.dll
Size

1.8MB
MD5

f821ea60a784956f522901cdd966476b
SHA1

c18507e50036c17356f5c360bbc03f197c42245c
SHA256

3f42e0b958ebefec7e8a8a7f3f498c8645e1424d0dc46e62fbbacd339294b4a4
SHA512

7fa3bf55664ff3f65b38ec7274449542b9db7292a3cc89353b84fd29663186766030c35665f995cba57bb7dd94473cb4fcf10d39bbb8f8ff79142c8aaf4dba63
SSDEEP

49152:xTUdhNF2pADrWdK4tv+E8211CPwDv3uFfJPy:1UdhNF2AMQE8W1CPwDv3uFfJ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2452 780 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1300 wrote to memory of 780	1300	rundll32.exe	rundll32.exe
PID 1300 wrote to memory of 780	1300	rundll32.exe	rundll32.exe
PID 1300 wrote to memory of 780	1300	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.3\libcrypto-1_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1300

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.3\libcrypto-1_1.dll,#1
2⤵
PID:780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 628
3⤵
- Program crash
PID:2452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 780 -ip 780
1⤵
PID:1360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...