229cbbac4a8000069d5ea52b0a864345b2e0a624f152f7f0472b942d2f269e29 | Triage

Analysis

max time kernel
78s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-06-2024 20:26

Sharing

Report Analysis Logs

General

Target

PvZ_Tools_v2.7.5/Qt5Core.dll
Size

4.3MB
MD5

f42a2786725e8caee162b048ecd4d6c0
SHA1

6bf6fd4aad32116a2f17499d121fbf592bacb5c8
SHA256

1e6cebc0e88690f25991554de04a75b91a0fda47a732930762c42309ca019049
SHA512

358c07c4ee4a5e012f9f7d514589ea3cfdd196a0bc3304c7380e3daa340f28bacdeec871e0b6332d36bf98b397f4d8ff4a9084d43da94e72f39afd0fcc196e37
SSDEEP

98304:dAhJjX07CI6XmIld1wRJRJsv6tWKFdu9CfvIWgw:yhJ1IBEdsJsv6tWKFdu9CfvF

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3900	1812	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 1812	2068	rundll32.exe	81
PID 2068 wrote to memory of 1812	2068	rundll32.exe	81
PID 2068 wrote to memory of 1812	2068	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.5\Qt5Core.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.5\Qt5Core.dll,#1
  2⤵
  PID:1812
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 676
    3⤵
    - Program crash
    PID:3900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1812 -ip 1812
1⤵
PID:2860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads