2a7bb07da52430c6aa6871dece4ad4a75938e44dd587bacee77f8b929d4bbcdf | Triage

Analysis

max time kernel
139s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 11:54

Sharing

Report Analysis Logs

General

Target

QQ超级农民/dp1.dll
Size

112KB
MD5

6d4b2e73f6f8ecff02f19f7e8ef9a8c7
SHA1

09c32ca167136a17fd69df8c525ea5ffeca6c534
SHA256

fe5783e64aa70fac10c2e42d460732d9770534357329d8bc78576557c165f040
SHA512

2fd7a95cb632e9c4ac6b34e5b6b875aae94e73cd4b1f213e78f46dadab4846227a030776461bca08f9d75a1d61a0d45427f7b0c8b71406b7debc14db04b2ce04
SSDEEP

1536:IxM5MufmW0C3flmskqT0qYvwDr3cFoWPrE:IxMmomWP3fQEFrsFoWT

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3496	3488	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 3488	4848	rundll32.exe	88
PID 4848 wrote to memory of 3488	4848	rundll32.exe	88
PID 4848 wrote to memory of 3488	4848	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQ超级农民\dp1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQ超级农民\dp1.dll,#1
  2⤵
  PID:3488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 600
    3⤵
    - Program crash
    PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3488 -ip 3488
1⤵
PID:1684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads