7c47c65f1aa589c33355d80b1dc26625a313d71538ea966ea921a90db11193ef | Triage

Analysis

max time kernel
46s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 09:59

Sharing

Report Analysis Logs

General

Target

QQ邮箱群发王1.0/UUWiseHelper.dll
Size

275KB
MD5

0acd9b058b3232b5c91242e24c39ac9c
SHA1

42871e8b89e6425f7872e1cf8fac3e337f021ebb
SHA256

1b3017c2998dad80a86cc759d8f63341a196d281591cbc2ea4d426426bf32ce0
SHA512

92ae4079bafb58a5e5beef30f0155c06bf38eaa5022eafdee46ba7967df153d5d534a915a2d1be6c1ab6b58b8ca90ecc7f24f4ef4fbbb6ca226f552b03942a6c
SSDEEP

6144:wR5HZVMrXa07zts3Xf7mNod1NwCTCXETH:M5Vi17ztimNo5wwCs

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1768 wrote to memory of 1112	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 1112	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 1112	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 1112	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 1112	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 1112	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 1112	1768	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQ邮箱群发王1.0\UUWiseHelper.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQ邮箱群发王1.0\UUWiseHelper.dll,#1
  2⤵
  PID:1112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1112-54-0x0000000000000000-mapping.dmp

Download
memory/1112-55-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download