70c2a521275bc55bf655177844375cdb385a58af41c3e6184f1eb007aea573ab | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/09/2022, 13:51

Sharing

Report Analysis Logs

General

Target

查找文本的工具/doc2text.dll
Size

98KB
MD5

615e1b0629604dfdf0bf116dc834233e
SHA1

ed481e4e81a427fb10189456128a19fe07a97cf7
SHA256

a244a266cf5f11474e6f66913b8e17e4d6e6ab234cc7b3f0520c636472f86dcf
SHA512

b1942f84dde0a2f47a3d69bc43114708343942e1ade57e0a88c45ae208f74b7e8cc043b8c2a3c9fc000ff73873c64285c5e0902a4c51ff3a0f8b04d6052d0549
SSDEEP

3072:pVyI+0yrbsg5rZNF6cwThl5vjqvdkxpIP+Rhy:Ls0cVHNF1wdrbqvqEP

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 2004	1280	rundll32.exe	28
PID 1280 wrote to memory of 2004	1280	rundll32.exe	28
PID 1280 wrote to memory of 2004	1280	rundll32.exe	28
PID 1280 wrote to memory of 2004	1280	rundll32.exe	28
PID 1280 wrote to memory of 2004	1280	rundll32.exe	28
PID 1280 wrote to memory of 2004	1280	rundll32.exe	28
PID 1280 wrote to memory of 2004	1280	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\查找文本的工具\doc2text.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\查找文本的工具\doc2text.dll,#1
  2⤵
  PID:2004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2004-55-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download