53d8cfe1f7ea99fff9531f5b608fc2b57ab24837b348ca6aa4b75ad945999291 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/01/2024, 03:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

梦幻法宝/jlyy.dll
Size

740KB
MD5

9babfeb008d949f69db9199c11b44bbb
SHA1

1ab7e20427c541fc1d1e4ad00e7c45476cf73bf5
SHA256

ca6a3f277077ba19f61925861ac1287f2e072e2d0aa1c75a85b46d11a1271c41
SHA512

15369ec519439983fba3bd6d128dd3c7721ad3215e734e2c88c9b5f8c51271531d8bad4170d6ad448bd15df6c936fce6f9fec288efaa5954e87b8cab20ec31cb
SSDEEP

12288:ACVLTCbmHVV1HFDYan6T3I28tFkHDQ70adyET2V:AOTCbqrHFDjQ3P8tFkHDQ7iET2V

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2408	616	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 616	1568	rundll32.exe	28
PID 1568 wrote to memory of 616	1568	rundll32.exe	28
PID 1568 wrote to memory of 616	1568	rundll32.exe	28
PID 1568 wrote to memory of 616	1568	rundll32.exe	28
PID 1568 wrote to memory of 616	1568	rundll32.exe	28
PID 1568 wrote to memory of 616	1568	rundll32.exe	28
PID 1568 wrote to memory of 616	1568	rundll32.exe	28
PID 616 wrote to memory of 2408	616	rundll32.exe	29
PID 616 wrote to memory of 2408	616	rundll32.exe	29
PID 616 wrote to memory of 2408	616	rundll32.exe	29
PID 616 wrote to memory of 2408	616	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\梦幻法宝\jlyy.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\梦幻法宝\jlyy.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 616 -s 244
    3⤵
    - Program crash
    PID:2408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads