d0dc732b59b08e0834495326b067a8e7fb2b8aad61dd0f545b79bb7ade06f7bc | Triage

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2022, 04:02

Sharing

Report Analysis Logs

General

Target

北京王码1998国标版(有1个)/PWBX3245.dll
Size

72KB
MD5

adfbea06fa58127153366fc877bc5644
SHA1

28baded7ee365b67f9c2bb884ab1ee64ab25731f
SHA256

635736e6825e6a9fc86b2d0a4de98df1367b6fe379613b2e14b9a8bc8c2ff2b7
SHA512

e29ea796188aa48fe7061a70f049a50b6d883d233d35bbf18c0966042284ab5da6c2fb53bac8597be31ec2b852f5c2a4032e377905f2302c8d844b49be38356d
SSDEEP

1536:Tf6Kb/bdwfUaC972AQrlYj96QsPkpI9ZFU:Tf6Kb/bdwfUx972AQrUVsPki

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 1208	2816	rundll32.exe	81
PID 2816 wrote to memory of 1208	2816	rundll32.exe	81
PID 2816 wrote to memory of 1208	2816	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\北京王码1998国标版(有1个)\PWBX3245.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\北京王码1998国标版(有1个)\PWBX3245.dll,#1
  2⤵
  PID:1208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads