9229bf3c95eefabaf00e4221c0ff71ad3cb8c842a813d8a5816af2b0b15bba06 | Triage

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 21:30

Sharing

Report Analysis Logs

General

Target

夢魔个人远控GHOST+.3.78美化版/MP3Enc.dll
Size

138KB
MD5

18230a6d17078ce4009baa99a425ee8d
SHA1

325984064a90f099e4d603c43ee89efaedc20e3a
SHA256

6822eb265957868141766320208c08ad85875bf85498eb176ecfd860907682b6
SHA512

22bb16d168760f40320e66f5c9222fb3dc798c9858699c4dcd293e2ec9380b964ca8d67cf3a95526e165f2dfa7fff8b5487653bdf00a36ce55ead9ceb5041178
SSDEEP

3072:Tv8PlwZEGazF9YS55qm1bBIqY8iR/sgwcKa2gQRjpp:4+ZwhtIBVuI7MFp

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1648 wrote to memory of 956	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 956	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 956	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 956	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 956	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 956	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 956	1648	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\夢魔个人远控GHOST+.3.78美化版\MP3Enc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1648

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\夢魔个人远控GHOST+.3.78美化版\MP3Enc.dll,#1
2⤵
PID:956

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/956-54-0x0000000000000000-mapping.dmp

Download
memory/956-55-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download
memory/956-56-0x0000000010000000-0x00000000100CE000-memory.dmp

Filesize
824KB

Download