a67841ce6c21b1e48913310654d1501e691052a92369dfcefa1f24690e834ed4

Analysis

max time kernel
125s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19-06-2024 19:39

Target

PP2008/funcmod/PPPT.dll
Size

256KB
MD5

3d76bc9c75649f55cd2981d2455e48d1
SHA1

a6a3a6f85854570ffab5b2472d44318500e5854e
SHA256

03b6d50ed063398ffd1c4c65fea187ebd0d91e33cfc989e35ef1634c712bbc63
SHA512

d06d1b11e5274e5b30fa7b60ce73a4b90d0714e8bcfce113d7e2925dd6e5fc4a887e2d8634e02f224bc71217b7c0344a88ab7127a395e60edc42cab260c5e6ed
SSDEEP

3072:KeC1a2nlXcU/8zkG5JzM+UVoD6/OSbxmFQZXrH4kzcjFzcr8XC1Hll6ksA1ssh35:vE95cUyn4omfx6EYkzkZcYX0xZ7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2064	4856	WerFault.exe	89

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ppuncompletefile.1\ = "PP下载未完成文件"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pp!	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pp!\ = "ppuncompletefile.1"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ppuncompletefile.1	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 4856	856	rundll32.exe	89
PID 856 wrote to memory of 4856	856	rundll32.exe	89
PID 856 wrote to memory of 4856	856	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PP2008\funcmod\PPPT.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PP2008\funcmod\PPPT.dll,#1
  2⤵
  - Modifies registry class
  PID:4856
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 736
    3⤵
    - Program crash
    PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4856 -ip 4856
1⤵
PID:2552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3756,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
1⤵
PID:3976