a3c508ce5ec079fbd0201301e72101ebeafaf39b972525a175fd5c5d46e7fb04

Analysis

max time kernel
33s
max time network
46s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2022, 09:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Edius_v6.02_的破解文件/lpk.dll
Size

61KB
MD5

c7dd44964be170becb663dc49a229f1f
SHA1

5be47ba7be673ce010a00726eea84b0c44ee6801
SHA256

d9ac567d4177608d9ceef753e44bbe3f7a534074f627131ac7441af41faa1b8e
SHA512

ea36e76ba70576ee92ff45eb1db52dbf2a28692cab2979b9acca3ec49fd538f58fae30b1dcb53f91d9af5aca7d95adc4d9dd467285c05ff006c48ae9f4ac0a4f
SSDEEP

1536:KNt2E5lBYVKYN4b1HZooqfZ9zksBXNt2E5l:talWKC4b1HZooqB9dB+al

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
5000	hrlA5AB.tmp
1200	AliveService.exe
4832	hrlA732.tmp

Loads dropped DLL 3 IoCs

pid	Process
5000	hrlA5AB.tmp
1200	AliveService.exe
4832	hrlA732.tmp

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Black.dll	AliveService.exe
File opened for modification	C:\Windows\SysWOW64\RCXA722.tmp	AliveService.exe
File created	C:\Windows\SysWOW64\Black.dll	hrlA732.tmp
File opened for modification	C:\Windows\SysWOW64\RCXA770.tmp	hrlA732.tmp
File created	C:\Windows\SysWOW64\AliveService.exe	hrlA5AB.tmp
File opened for modification	C:\Windows\SysWOW64\AliveService.exe	hrlA5AB.tmp
File created	C:\Windows\SysWOW64\Black.dll	hrlA5AB.tmp

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5000	hrlA5AB.tmp
5000	hrlA5AB.tmp
1200	AliveService.exe
1200	AliveService.exe
4832	hrlA732.tmp
4832	hrlA732.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 5028	4528	rundll32.exe	81
PID 4528 wrote to memory of 5028	4528	rundll32.exe	81
PID 4528 wrote to memory of 5028	4528	rundll32.exe	81
PID 5028 wrote to memory of 5000	5028	rundll32.exe	83
PID 5028 wrote to memory of 5000	5028	rundll32.exe	83
PID 5028 wrote to memory of 5000	5028	rundll32.exe	83
PID 1200 wrote to memory of 4832	1200	AliveService.exe	85
PID 1200 wrote to memory of 4832	1200	AliveService.exe	85
PID 1200 wrote to memory of 4832	1200	AliveService.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Edius_v6.02_的破解文件\lpk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Edius_v6.02_的破解文件\lpk.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Users\Admin\AppData\Local\Temp\hrlA5AB.tmp
    C:\Users\Admin\AppData\Local\Temp\hrlA5AB.tmp
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of SetWindowsHookEx
    PID:5000

C:\Windows\SysWOW64\AliveService.exe
C:\Windows\SysWOW64\AliveService.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\TEMP\hrlA732.tmp
  C:\Windows\TEMP\hrlA732.tmp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:4832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hrlA5AB.tmp

Filesize
52KB

MD5
9525e82ddc27d7aa9a2c6b87eb9813db

SHA1
99c522d5543eba4558aa9c0d616d994aca33b70c

SHA256
2bb01eb21cdcd7557b5cb76a38b89faf1cb928050999eb50668ca0f9d4908dfb

SHA512
30ca0336e564f039ec878176acbd31b8ad1bdb196d77942444a464cd20c385963502b68f3abc060663b63a7af74408b38ff3776de62dc24e6fd044cc005cf117

Download Submit
C:\Users\Admin\AppData\Local\Temp\hrlA5AB.tmp

Filesize
52KB

MD5
9525e82ddc27d7aa9a2c6b87eb9813db

SHA1
99c522d5543eba4558aa9c0d616d994aca33b70c

SHA256
2bb01eb21cdcd7557b5cb76a38b89faf1cb928050999eb50668ca0f9d4908dfb

SHA512
30ca0336e564f039ec878176acbd31b8ad1bdb196d77942444a464cd20c385963502b68f3abc060663b63a7af74408b38ff3776de62dc24e6fd044cc005cf117

Download Submit
C:\Windows\SysWOW64\AliveService.exe

Filesize
52KB

MD5
9525e82ddc27d7aa9a2c6b87eb9813db

SHA1
99c522d5543eba4558aa9c0d616d994aca33b70c

SHA256
2bb01eb21cdcd7557b5cb76a38b89faf1cb928050999eb50668ca0f9d4908dfb

SHA512
30ca0336e564f039ec878176acbd31b8ad1bdb196d77942444a464cd20c385963502b68f3abc060663b63a7af74408b38ff3776de62dc24e6fd044cc005cf117

Download Submit
C:\Windows\SysWOW64\AliveService.exe

Filesize
52KB

MD5
9525e82ddc27d7aa9a2c6b87eb9813db

SHA1
99c522d5543eba4558aa9c0d616d994aca33b70c

SHA256
2bb01eb21cdcd7557b5cb76a38b89faf1cb928050999eb50668ca0f9d4908dfb

SHA512
30ca0336e564f039ec878176acbd31b8ad1bdb196d77942444a464cd20c385963502b68f3abc060663b63a7af74408b38ff3776de62dc24e6fd044cc005cf117

Download Submit
C:\Windows\SysWOW64\Black.dll

Filesize
9KB

MD5
331322b2ae6a0253f48b3e82b4e33064

SHA1
45227685bb88d13a9c2e0632549933d9137601e4

SHA256
b2bc01eedf594afd74471a0a128a573f1e4a518501334d66a5c00c9ccc0fbbcb

SHA512
2d34a2da2bf23dc6c8b3e250aee7db6719a8d4fd0f83dc73cab04cf348b84aadc1bea2c4ce38f63a523531668df9e52a8f4adfee37a6f694b1a1faebf9127417

Download Submit
C:\Windows\SysWOW64\Black.dll

Filesize
9KB

MD5
331322b2ae6a0253f48b3e82b4e33064

SHA1
45227685bb88d13a9c2e0632549933d9137601e4

SHA256
b2bc01eedf594afd74471a0a128a573f1e4a518501334d66a5c00c9ccc0fbbcb

SHA512
2d34a2da2bf23dc6c8b3e250aee7db6719a8d4fd0f83dc73cab04cf348b84aadc1bea2c4ce38f63a523531668df9e52a8f4adfee37a6f694b1a1faebf9127417

Download Submit
C:\Windows\SysWOW64\Black.dll

Filesize
61KB

MD5
c7dd44964be170becb663dc49a229f1f

SHA1
5be47ba7be673ce010a00726eea84b0c44ee6801

SHA256
d9ac567d4177608d9ceef753e44bbe3f7a534074f627131ac7441af41faa1b8e

SHA512
ea36e76ba70576ee92ff45eb1db52dbf2a28692cab2979b9acca3ec49fd538f58fae30b1dcb53f91d9af5aca7d95adc4d9dd467285c05ff006c48ae9f4ac0a4f

Download Submit
C:\Windows\SysWOW64\Black.dll

Filesize
61KB

MD5
c7dd44964be170becb663dc49a229f1f

SHA1
5be47ba7be673ce010a00726eea84b0c44ee6801

SHA256
d9ac567d4177608d9ceef753e44bbe3f7a534074f627131ac7441af41faa1b8e

SHA512
ea36e76ba70576ee92ff45eb1db52dbf2a28692cab2979b9acca3ec49fd538f58fae30b1dcb53f91d9af5aca7d95adc4d9dd467285c05ff006c48ae9f4ac0a4f

Download Submit
C:\Windows\SysWOW64\Black.dll

Filesize
61KB

MD5
c7dd44964be170becb663dc49a229f1f

SHA1
5be47ba7be673ce010a00726eea84b0c44ee6801

SHA256
d9ac567d4177608d9ceef753e44bbe3f7a534074f627131ac7441af41faa1b8e

SHA512
ea36e76ba70576ee92ff45eb1db52dbf2a28692cab2979b9acca3ec49fd538f58fae30b1dcb53f91d9af5aca7d95adc4d9dd467285c05ff006c48ae9f4ac0a4f

Download Submit
C:\Windows\TEMP\hrlA732.tmp

Filesize
52KB

MD5
9525e82ddc27d7aa9a2c6b87eb9813db

SHA1
99c522d5543eba4558aa9c0d616d994aca33b70c

SHA256
2bb01eb21cdcd7557b5cb76a38b89faf1cb928050999eb50668ca0f9d4908dfb

SHA512
30ca0336e564f039ec878176acbd31b8ad1bdb196d77942444a464cd20c385963502b68f3abc060663b63a7af74408b38ff3776de62dc24e6fd044cc005cf117

Download Submit
C:\Windows\Temp\hrlA732.tmp

Filesize
52KB

MD5
9525e82ddc27d7aa9a2c6b87eb9813db

SHA1
99c522d5543eba4558aa9c0d616d994aca33b70c

SHA256
2bb01eb21cdcd7557b5cb76a38b89faf1cb928050999eb50668ca0f9d4908dfb

SHA512
30ca0336e564f039ec878176acbd31b8ad1bdb196d77942444a464cd20c385963502b68f3abc060663b63a7af74408b38ff3776de62dc24e6fd044cc005cf117

Download Submit