Overview
overview
7Static
static
7MM性高�...��.url
windows7-x64
1MM性高�...��.url
windows10-2004-x64
1林达QQ�...ry.dll
windows7-x64
1林达QQ�...ry.dll
windows10-2004-x64
3林达QQ�...��.url
windows7-x64
1林达QQ�...��.url
windows10-2004-x64
1林达QQ�...��.url
windows7-x64
1林达QQ�...��.url
windows10-2004-x64
1林达QQ�...��.exe
windows7-x64
1林达QQ�...��.exe
windows10-2004-x64
1Analysis
-
max time kernel
138s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16-05-2024 10:52
Behavioral task
behavioral1
Sample
MM性高潮_超爽在线小游戏.url
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
MM性高潮_超爽在线小游戏.url
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
林达QQ相册密码破解器/library.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
林达QQ相册密码破解器/library.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
林达QQ相册密码破解器/七喜下载站更多精品纯净绿色软件下载.url
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
林达QQ相册密码破解器/七喜下载站更多精品纯净绿色软件下载.url
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
林达QQ相册密码破解器/推荐-2011给力火暴在线小游戏.url
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
林达QQ相册密码破解器/推荐-2011给力火暴在线小游戏.url
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
林达QQ相册密码破解器/林达QQ相册密码破解器.exe
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
林达QQ相册密码破解器/林达QQ相册密码破解器.exe
Resource
win10v2004-20240508-en
General
-
Target
林达QQ相册密码破解器/library.dll
-
Size
243KB
-
MD5
c8283132195b3618228883a3ffda7d66
-
SHA1
6c1bdf36c3da538810a70a9df372e9a6240e8736
-
SHA256
57758495dedf8568271182564f5c6ca17ee8fc89fc2ea76f1e990da8d035b6ba
-
SHA512
f1926f5dbfc58ceaf6cfb2ccb6216760a8fd6a9d88c9bc524f194f2b52c73c4bc96a86ea21fd30cc6fdd9eb9171ac4f10e345852712074143ec0a8f625804cab
-
SSDEEP
6144:Dkj21LRvNdUEeKJ6wr1EMmEAUgKJeaHxu6XZXq4t54MJu:DkjaRWKJHr1zmEACfw6JqI54M
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3348 452 WerFault.exe 82 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2792 wrote to memory of 452 2792 rundll32.exe 82 PID 2792 wrote to memory of 452 2792 rundll32.exe 82 PID 2792 wrote to memory of 452 2792 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\林达QQ相册密码破解器\library.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\林达QQ相册密码破解器\library.dll,#12⤵PID:452
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 452 -s 5883⤵
- Program crash
PID:3348
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 452 -ip 4521⤵PID:4564