2097a149a34a2744d20b9ce971ef1d013d09b1da6f97f4683dd51229bfc4bef0 | Triage

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 04:58

Sharing

Report Analysis Logs

General

Target

啊哈C/SciLexer.dll
Size

523KB
MD5

4cd91a2a1504d636dff91ec7f9a6f895
SHA1

f91ebb9c20ebafd1e0cd88d17fb21f156ef465c3
SHA256

0a1e46303327adffdf5921cc39e6f7f78e1f733e2b4e3f03d4a4751ba1664bfe
SHA512

b7578151726835624dbadac936d69385e2c75771540db319361772fc1d45fb4d26274b350f0a287013ffba44de7bbef65e63b41c3d906a5bab84ab38029de0c4
SSDEEP

12288:OqzVbP/Gi3cDxm8fEcLWxmWT0dJQ1yB9ArOt:OW5N3cDxm8fHLWxmWT0TZQi

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2980	1748	WerFault.exe	14

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 1748	2500	rundll32.exe	14
PID 2500 wrote to memory of 1748	2500	rundll32.exe	14
PID 2500 wrote to memory of 1748	2500	rundll32.exe	14
PID 2500 wrote to memory of 1748	2500	rundll32.exe	14
PID 2500 wrote to memory of 1748	2500	rundll32.exe	14
PID 2500 wrote to memory of 1748	2500	rundll32.exe	14
PID 2500 wrote to memory of 1748	2500	rundll32.exe	14
PID 1748 wrote to memory of 2980	1748	rundll32.exe	15
PID 1748 wrote to memory of 2980	1748	rundll32.exe	15
PID 1748 wrote to memory of 2980	1748	rundll32.exe	15
PID 1748 wrote to memory of 2980	1748	rundll32.exe	15

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\啊哈C\SciLexer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 220
  2⤵
  - Program crash
  PID:2980

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\啊哈C\SciLexer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads