1fba70ed0852b48ecbaa9ccf74f5ba50f32e720929584e1350f638d4510e79fd | Triage

Analysis

max time kernel
90s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15-10-2022 01:02

Sharing

Report Analysis Logs

General

Target

象棋奇兵 5.0/lang_eng.dll
Size

224KB
MD5

76926b6ea25e4dec7b25459e88c076d5
SHA1

cf2ca62cbf58de3211b4e071e8f3137f791201e2
SHA256

e9989aaf40a2a2f919b3dc1d53ebbb21bf4039a699d23bbedc5def7a384bd795
SHA512

397d5584cc4ca39e2030d7fae89505dc48cafa66f34f4f56d4455acd58c69057112d85609c6f7c3a6e3731f3a0a57ffc3fee790c071f1d87ece26201cc8a73b4
SSDEEP

3072:40X2AtDFhUUxIwv90n4gBM8OILYQfBpk1pO8Dyt:4o2ohUUxIZvs0p/

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 4740	4720	rundll32.exe	82
PID 4720 wrote to memory of 4740	4720	rundll32.exe	82
PID 4720 wrote to memory of 4740	4720	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\象棋奇兵 5.0\lang_eng.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\象棋奇兵 5.0\lang_eng.dll",#1
  2⤵
  PID:4740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4740-132-0x0000000000000000-mapping.dmp

Download