ac6d3f36922917f8ac7873fbc4a0a06334daf12c04bd6e4809ff56d7c2283a84

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 07:46

Target

联通宽带拨号客户端/MSVCP60D.dll
Size

504KB
MD5

7df2f6b39b55c3f09be45229abba18c0
SHA1

55ffefb0a33bce9f81a229fa34a4ba7f6bca9aef
SHA256

509df87c41b21e251ba692776013fd3745a51cc147a776910675bfb46ddc98dd
SHA512

2e7ddd6666d06e7af285d0453e4deee6360b0ae51004915c6e2fd22c200d9d04990e82df04cddf28a88a278e1cb2ceff0df8384483839cca9cf00596dc2e6b4a
SSDEEP

12288:/ygHEPY6hY5jIXVc22+kqEzcM+X90ktKuq3OoxHkC9a:aVc22/1+X90ktPq3OoxHkC9a

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1740	1632	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1632	1656	rundll32.exe	30
PID 1656 wrote to memory of 1632	1656	rundll32.exe	30
PID 1656 wrote to memory of 1632	1656	rundll32.exe	30
PID 1656 wrote to memory of 1632	1656	rundll32.exe	30
PID 1656 wrote to memory of 1632	1656	rundll32.exe	30
PID 1656 wrote to memory of 1632	1656	rundll32.exe	30
PID 1656 wrote to memory of 1632	1656	rundll32.exe	30
PID 1632 wrote to memory of 1740	1632	rundll32.exe	31
PID 1632 wrote to memory of 1740	1632	rundll32.exe	31
PID 1632 wrote to memory of 1740	1632	rundll32.exe	31
PID 1632 wrote to memory of 1740	1632	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\联通宽带拨号客户端\MSVCP60D.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\联通宽带拨号客户端\MSVCP60D.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 224
    3⤵
    - Program crash
    PID:1740