6cfa3862398d64d283a9829c61ab946984844481025ab45937861e5c9a871699

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 00:55

Target

VPN-517vpn免费版/517vpn.dll
Size

75KB
MD5

e96957508e4351e6aea0b27301a92dd4
SHA1

288fb6ff9e3dc20b583140c71ff83b4baf03d8b8
SHA256

ef2537650867d0377866d3c02c01552dc201785bf6dfd8a43614f36b5ca855f6
SHA512

daf00b613143cde16440669ae66bc863d79ff58b1d69b361c7fefb5dd2bf7ea3450ac13fee043878662e85b41e125f04b8e0144b9e5c1c3e6095c7292c360f20
SSDEEP

768:73wwoUwfqeTCIDliTD2rGuXme3wYJ9c3vrVhhogT/YHO/fluYfpNLJek:73wRZUTDktXmMwY7c3vn0cluYbb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2900	2748	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2748	2852	rundll32.exe	28
PID 2852 wrote to memory of 2748	2852	rundll32.exe	28
PID 2852 wrote to memory of 2748	2852	rundll32.exe	28
PID 2852 wrote to memory of 2748	2852	rundll32.exe	28
PID 2852 wrote to memory of 2748	2852	rundll32.exe	28
PID 2852 wrote to memory of 2748	2852	rundll32.exe	28
PID 2852 wrote to memory of 2748	2852	rundll32.exe	28
PID 2748 wrote to memory of 2900	2748	rundll32.exe	29
PID 2748 wrote to memory of 2900	2748	rundll32.exe	29
PID 2748 wrote to memory of 2900	2748	rundll32.exe	29
PID 2748 wrote to memory of 2900	2748	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VPN-517vpn免费版\517vpn.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\VPN-517vpn免费版\517vpn.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 344
    3⤵
    - Program crash
    PID:2900