1fba70ed0852b48ecbaa9ccf74f5ba50f32e720929584e1350f638d4510e79fd | Triage

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2022, 01:02

Sharing

Report Analysis Logs

General

Target

象棋奇兵 5.0/lang_gb.dll
Size

220KB
MD5

ad9c4a24e957bb24120a22de3b80a9e4
SHA1

d70be1248bd7b15ca8a00dbc56ce00d1a1c3f0a8
SHA256

2194c943b305019b9d81982589f0f6b0149752a2c0659b5b8b972b257139e23c
SHA512

234fd327a9ec27003395af6e93f309cf0ef9509b17c470ea5eaf9f9c91096c7ff98e07cd6c952705c41dc58e3c9e46a24b2d1c4254bbe89e3cff07b9c52b228a
SSDEEP

3072:f0X2+4DF9UxIwvnBM8OILYQfBpk1jwDyt:fo279UxIWvs0pY

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 2152	1448	rundll32.exe	82
PID 1448 wrote to memory of 2152	1448	rundll32.exe	82
PID 1448 wrote to memory of 2152	1448	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\象棋奇兵 5.0\lang_gb.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\象棋奇兵 5.0\lang_gb.dll",#1
  2⤵
  PID:2152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads