d0dc732b59b08e0834495326b067a8e7fb2b8aad61dd0f545b79bb7ade06f7bc | Triage

Analysis

max time kernel
83s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2022, 04:02

Sharing

Report Analysis Logs

General

Target

北京王码1998国标版(有1个)/PWMPY32.dll
Size

72KB
MD5

b5552fef9cf6b4834db4b8242bf54bc6
SHA1

855f4711631ac04c34328c3a392be21f20616eca
SHA256

66f53f7951bb4730f5014dadef5ff73554529ea1ad522e352fee71addebb0aed
SHA512

1adcda935af1c5604b480783fc08235d3cfc7679d6fbd8e3716d6e680b14af497ed337061f96aa2f0c22013e4973a8f64fed63880f09d5451a593b004ab25440
SSDEEP

1536:C83WKWLnabkwKqxIfBnDLy4UxQkbiWr5hVZ:p3WKWLnabkwZx0BnDLy8kbi6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 1328	2392	rundll32.exe	82
PID 2392 wrote to memory of 1328	2392	rundll32.exe	82
PID 2392 wrote to memory of 1328	2392	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\北京王码1998国标版(有1个)\PWMPY32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\北京王码1998国标版(有1个)\PWMPY32.dll,#1
  2⤵
  PID:1328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads