bced812112439dc85b04747045a0a19ee4b6d9f9ca0b378390e41379ffdb9f9d | Triage

Analysis

max time kernel
293s
max time network
297s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2023 12:11

Sharing

Report Analysis Logs

General

Target

PvZ_Tools_v2.7.3/Qt5Widgets.dll
Size

3.6MB
MD5

0adaf8da00e16c7d1146fd034a2be91c
SHA1

29dbcd69e0d373257dd3bb8346b6927511859e1d
SHA256

6cb22ecef1ee09e83f621db48d4b05d32d515bcf5943017a5e822eb7b1f538a0
SHA512

80223bf6525f638836a6dbf23b4f16fe64edacc2ceac58869dbfd890876665e0685ec83bd796a0eaaa573c8e4bc10c0076a4cd9540ce923e2bfd688cc563b7d8
SSDEEP

49152:3SlT4oPRSxtKyu8KkBO5aU19TwNrfhPrTp:YTk5nOMUrT8pP

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5044 4624 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1052 wrote to memory of 4624	1052	rundll32.exe	rundll32.exe
PID 1052 wrote to memory of 4624	1052	rundll32.exe	rundll32.exe
PID 1052 wrote to memory of 4624	1052	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.3\Qt5Widgets.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1052

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.3\Qt5Widgets.dll,#1
2⤵
PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 704
3⤵
- Program crash
PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4624 -ip 4624
1⤵
PID:1872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...