844d58d383112e99af0fc5f60401de4006e3ee3512ab58749e41746078c588d7 | Triage

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
28/08/2023, 18:09

Sharing

Report Analysis Logs

General

Target

GenshinImpact代理.exe
Size

4.1MB
MD5

2d43d2344e5b6fe2921352f1b601f5f4
SHA1

b18f78758d2f333380cc50643edf16077506bf29
SHA256

844d58d383112e99af0fc5f60401de4006e3ee3512ab58749e41746078c588d7
SHA512

357b67425c6f3c70a83f3035dd0a5337f33eba66d2f15da552dc1c1bad06204aaa9eaddeaa9a9d5e6abc1a387fbc86b798223a2bc582132557ecd2a2a541201a
SSDEEP

49152:LITi3ioSjFs/hSzA3/IbNB9rQqxPU6BjmkI+vjtIMcs8rtw:UTiSoSjFrzA3/wNB9rlBww

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\netfilter2.sys	GenshinImpact代理.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4136	2460	WerFault.exe	81

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2460	GenshinImpact代理.exe
2460	GenshinImpact代理.exe

C:\Users\Admin\AppData\Local\Temp\GenshinImpact代理.exe
"C:\Users\Admin\AppData\Local\Temp\GenshinImpact代理.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of SetWindowsHookEx
PID:2460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 844
  2⤵
  - Program crash
  PID:4136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 124 -p 2460 -ip 2460
1⤵
PID:1060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads