85cb565aba61c39ecf383bb70128742d92e0f48997860fd6a15f2749d7bd7e69 | Triage

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-10-2022 16:52

Sharing

Report Analysis Logs

General

Target

VCE1.0.2（软件会提示升级，勿升级）/libcryptvce.dll
Size

283KB
MD5

d06d35ec41bce18ca23ba212029cc53e
SHA1

1b7620b09e0ed9bee8388a699724268b7c185811
SHA256

251df2a0871330c57859ea803dbe14c291d358213cd36172ba4bf62c13b4a10f
SHA512

c819a6f2a5e839ebdef8271ee4fd27d3f84a95e0b9fcc9ae3c74595a327e005e45027108a07dd355129ef8dbe435110e087c74067cb31fbc10362f16ff7aa83d
SSDEEP

6144:Qt86rYr76vtGZyonUgxhL7UI7Wh/XS3sTfsUZzN:68P/6Ux9b7Wh/Xdb

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1336 wrote to memory of 1176	1336	rundll32.exe	rundll32.exe
PID 1336 wrote to memory of 1176	1336	rundll32.exe	rundll32.exe
PID 1336 wrote to memory of 1176	1336	rundll32.exe	rundll32.exe
PID 1336 wrote to memory of 1176	1336	rundll32.exe	rundll32.exe
PID 1336 wrote to memory of 1176	1336	rundll32.exe	rundll32.exe
PID 1336 wrote to memory of 1176	1336	rundll32.exe	rundll32.exe
PID 1336 wrote to memory of 1176	1336	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VCE1.0.2（软件会提示升级，勿升级）\libcryptvce.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1336

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VCE1.0.2（软件会提示升级，勿升级）\libcryptvce.dll,#1
2⤵
PID:1176

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1176-54-0x0000000000000000-mapping.dmp

Download
memory/1176-55-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download