b77c9868fe8283f2eff9cefc327b9f0625f9a75265235521a28c5940ee040450

Analysis

max time kernel
151s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 04:09

Target
服务端/unrar.dll
Size 154KB
Sample240314-eqt2vaab2z
SHA256 2a308fbd4ff115349b968b2386140ba09d5f3cb35f82a2f8b96d4c50d03b2d3f
MD5 35aac587c0fe1e407ff60f2b3361be59
SHA1 1e6ce5ecdb8da137766ccd3b8ffe435ec7a6b714
SHA512 30be5ecc9a3cfdd8b500958f0d831641292eb6255b46578952faccee93d245fd8db77a40fe356c8cf3c82589ed72979ac520620562e98f530e9a155978a68668
SSDEEP 3072:aK+06LCZpzws6HLXtusCMbWhXS+fN9HFrvpBV8eh1yBDUG2klq0eBeR2M0zBr:JPjZpz7ALXtBbeS+fDHNEUG2k3eoR2MM
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4508	4572	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 4572	4816	rundll32.exe	88
PID 4816 wrote to memory of 4572	4816	rundll32.exe	88
PID 4816 wrote to memory of 4572	4816	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\服务端\unrar.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\服务端\unrar.dll,#1
  2⤵
  PID:4572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 612
    3⤵
    - Program crash
    PID:4508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4572 -ip 4572
1⤵
PID:2848

memory/4572-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download