844d58d383112e99af0fc5f60401de4006e3ee3512ab58749e41746078c588d7 | Triage

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
28/08/2023, 18:09

Sharing

Report Analysis Logs

General

Target

GenshinImpact代理.exe
Size

4.1MB
MD5

2d43d2344e5b6fe2921352f1b601f5f4
SHA1

b18f78758d2f333380cc50643edf16077506bf29
SHA256

844d58d383112e99af0fc5f60401de4006e3ee3512ab58749e41746078c588d7
SHA512

357b67425c6f3c70a83f3035dd0a5337f33eba66d2f15da552dc1c1bad06204aaa9eaddeaa9a9d5e6abc1a387fbc86b798223a2bc582132557ecd2a2a541201a
SSDEEP

49152:LITi3ioSjFs/hSzA3/IbNB9rQqxPU6BjmkI+vjtIMcs8rtw:UTiSoSjFrzA3/wNB9rlBww

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\netfilter2.sys	GenshinImpact代理.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2652	2624	WerFault.exe	27

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2624	GenshinImpact代理.exe
2624	GenshinImpact代理.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2652	2624	GenshinImpact代理.exe	28
PID 2624 wrote to memory of 2652	2624	GenshinImpact代理.exe	28
PID 2624 wrote to memory of 2652	2624	GenshinImpact代理.exe	28
PID 2624 wrote to memory of 2652	2624	GenshinImpact代理.exe	28

C:\Users\Admin\AppData\Local\Temp\GenshinImpact代理.exe
"C:\Users\Admin\AppData\Local\Temp\GenshinImpact代理.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 304
  2⤵
  - Program crash
  PID:2652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads