70c2a521275bc55bf655177844375cdb385a58af41c3e6184f1eb007aea573ab | Triage

Analysis

max time kernel
143s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-09-2022 13:51

Sharing

Report Analysis Logs

General

Target

查找文本的工具/doc2text.dll
Size

98KB
MD5

615e1b0629604dfdf0bf116dc834233e
SHA1

ed481e4e81a427fb10189456128a19fe07a97cf7
SHA256

a244a266cf5f11474e6f66913b8e17e4d6e6ab234cc7b3f0520c636472f86dcf
SHA512

b1942f84dde0a2f47a3d69bc43114708343942e1ade57e0a88c45ae208f74b7e8cc043b8c2a3c9fc000ff73873c64285c5e0902a4c51ff3a0f8b04d6052d0549
SSDEEP

3072:pVyI+0yrbsg5rZNF6cwThl5vjqvdkxpIP+Rhy:Ls0cVHNF1wdrbqvqEP

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/748-133-0x0000000000400000-0x0000000000445000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 748	2916	rundll32.exe	79
PID 2916 wrote to memory of 748	2916	rundll32.exe	79
PID 2916 wrote to memory of 748	2916	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\查找文本的工具\doc2text.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\查找文本的工具\doc2text.dll,#1
  2⤵
  PID:748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/748-133-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download