7ac69e9c3c906d311447b1f4235f1047673ce3b4882c5d45d8e2c60de6152972 | Triage

Analysis

max time kernel
49s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13-04-2023 02:38

Sharing

Report Analysis Logs

General

Target

湖南婚姻/VCRUNTIME140.dll
Size

94KB
MD5

a87575e7cf8967e481241f13940ee4f7
SHA1

879098b8a353a39e16c79e6479195d43ce98629e
SHA256

ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
SHA512

e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP

1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1296	924	WerFault.exe	20

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	364	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	364	AUDIODG.EXE
Token: 33	364	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	364	AUDIODG.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 1296	924	rundll32.exe	27
PID 924 wrote to memory of 1296	924	rundll32.exe	27
PID 924 wrote to memory of 1296	924	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\湖南婚姻\VCRUNTIME140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:924
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 924 -s 84
  2⤵
  - Program crash
  PID:1296

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1488

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads