a67841ce6c21b1e48913310654d1501e691052a92369dfcefa1f24690e834ed4

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
19/06/2024, 19:39

Target

PP2008/funcmod/PPPT.dll
Size

256KB
MD5

3d76bc9c75649f55cd2981d2455e48d1
SHA1

a6a3a6f85854570ffab5b2472d44318500e5854e
SHA256

03b6d50ed063398ffd1c4c65fea187ebd0d91e33cfc989e35ef1634c712bbc63
SHA512

d06d1b11e5274e5b30fa7b60ce73a4b90d0714e8bcfce113d7e2925dd6e5fc4a887e2d8634e02f224bc71217b7c0344a88ab7127a395e60edc42cab260c5e6ed
SSDEEP

3072:KeC1a2nlXcU/8zkG5JzM+UVoD6/OSbxmFQZXrH4kzcjFzcr8XC1Hll6ksA1ssh35:vE95cUyn4omfx6EYkzkZcYX0xZ7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2388	1156	WerFault.exe	28

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ppuncompletefile.1	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ppuncompletefile.1\ = "PP下载未完成文件"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pp!	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pp!\ = "ppuncompletefile.1"	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 1156	2948	rundll32.exe	28
PID 2948 wrote to memory of 1156	2948	rundll32.exe	28
PID 2948 wrote to memory of 1156	2948	rundll32.exe	28
PID 2948 wrote to memory of 1156	2948	rundll32.exe	28
PID 2948 wrote to memory of 1156	2948	rundll32.exe	28
PID 2948 wrote to memory of 1156	2948	rundll32.exe	28
PID 2948 wrote to memory of 1156	2948	rundll32.exe	28
PID 1156 wrote to memory of 2388	1156	rundll32.exe	29
PID 1156 wrote to memory of 2388	1156	rundll32.exe	29
PID 1156 wrote to memory of 2388	1156	rundll32.exe	29
PID 1156 wrote to memory of 2388	1156	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PP2008\funcmod\PPPT.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PP2008\funcmod\PPPT.dll,#1
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 268
    3⤵
    - Program crash
    PID:2388