5acd875611e7622ff7b4a922262a49897693943625d5b497f62eb3e7d903b186

Analysis

max time kernel
144s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 17:07

Target

豪迪QQ群发7.7 破解版/GetInfo.dll
Size

41KB
MD5

eedbb80f1f86de86a725e732e59b57bc
SHA1

0db7783259907768cf8f300a2953707d926afa16
SHA256

a42a94dbb4ed29fd71b0d4e67082bb01cf678d08582f46fe16f1c88b9e58f946
SHA512

c82e86a9fccfba73c051eb462080a950f047b706f904f3a2fc75bbbce1d1892c1c6f22521fe0f661b8a39c4cab368cda6a46a3f431bde4528281cabc2420977c
SSDEEP

768:WCpqOQdwHPoBuUSdB6zW/U9Bok+VN5KvwEW3XkjTkd4Btd8VeGiSB8xZ:RpqOQYM9SzsoBBta78E9SmxZ

Score

6^/10

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

rundll32.exe

description ioc process

File opened for modification \??\PhysicalDrive0 rundll32.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4068 wrote to memory of 4896	4068	rundll32.exe	rundll32.exe
PID 4068 wrote to memory of 4896	4068	rundll32.exe	rundll32.exe
PID 4068 wrote to memory of 4896	4068	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\豪迪QQ群发7.7 破解版\GetInfo.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4068

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\豪迪QQ群发7.7 破解版\GetInfo.dll",#1
2⤵
- Writes to the Master Boot Record (MBR)
PID:4896

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/4896-132-0x0000000000000000-mapping.dmp

Download
memory/4896-133-0x0000000000420000-0x000000000042F000-memory.dmp

Filesize
60KB

Download