657b2113c545a98733210f01cd3fecff8933a9da09c815ddb75792d22706d67c | Triage

Analysis

max time kernel
155s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 17:00

Sharing

Report Analysis Logs

General

Target

身份证号码批量升级/internet.dll
Size

192KB
MD5

0503d44bada9a0c7138b3f7d3ab90693
SHA1

c4ea03151eeedd1c84beaa06e73faa9c1e9574fc
SHA256

7c077b6806738e62a9c2e38cc2ffefefd362049e3780b06a862210f1350d003e
SHA512

f14dfa273b514753312e1dfc873ac501d6aa7bbd17cd63d16f3bcb9caddcb5ea349c072e73448a2beb3b1010c674be9c8ad22257d8c7b65a3a05e77e69d3b7a8
SSDEEP

3072:tkaaguNk1Th6jTFWBBMzlRjEg07N6QlMCyjrWzokcTaY9+S3UHQ:tOJOSIBBPg0xJMCyeYaLSi

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 336 wrote to memory of 4932	336	rundll32.exe	rundll32.exe
PID 336 wrote to memory of 4932	336	rundll32.exe	rundll32.exe
PID 336 wrote to memory of 4932	336	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\身份证号码批量升级\internet.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\身份证号码批量升级\internet.dll,#1
  2⤵
  PID:4932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4932-132-0x0000000000000000-mapping.dmp

Download