b77c9868fe8283f2eff9cefc327b9f0625f9a75265235521a28c5940ee040450

Analysis

max time kernel
121s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 04:09

Target

服务端/IPSearcher.dll
Size

33KB
MD5

3704fbcaf369b4ed8f6cb2bcfcf6828c
SHA1

0753c277ce8a8ecefcf452a936fa305750412a83
SHA256

f25c9238a44aa3c218d6af84a4735b674c19700b38e789a3e2b2df4d3005afda
SHA512

66d485701c8b466e291abe8e4e0a7d127b4be25ee73326cf6610dbf9cb99dcd617bb2369e8a7f6497ce4b3cf151842a364d1a4a2f90d16386babcdbcebe4b875
SSDEEP

384:nEFy8hY9Yv8mlvWtgPTOe33FSkjNB9yqagJOqImHbo9RvY+G7+GU+GsD+Gx:ncy8hjet4TOe31SkjFtzJOqIm7o9tK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2572	2160	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2160	2724	rundll32.exe	28
PID 2724 wrote to memory of 2160	2724	rundll32.exe	28
PID 2724 wrote to memory of 2160	2724	rundll32.exe	28
PID 2724 wrote to memory of 2160	2724	rundll32.exe	28
PID 2724 wrote to memory of 2160	2724	rundll32.exe	28
PID 2724 wrote to memory of 2160	2724	rundll32.exe	28
PID 2724 wrote to memory of 2160	2724	rundll32.exe	28
PID 2160 wrote to memory of 2572	2160	rundll32.exe	29
PID 2160 wrote to memory of 2572	2160	rundll32.exe	29
PID 2160 wrote to memory of 2572	2160	rundll32.exe	29
PID 2160 wrote to memory of 2572	2160	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\服务端\IPSearcher.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\服务端\IPSearcher.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 248
    3⤵
    - Program crash
    PID:2572