9229bf3c95eefabaf00e4221c0ff71ad3cb8c842a813d8a5816af2b0b15bba06 | Triage

Analysis

max time kernel
201s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 21:30

Sharing

Report Analysis Logs

General

Target

夢魔个人远控GHOST+.3.78美化版/MP3Enc.dll
Size

138KB
MD5

18230a6d17078ce4009baa99a425ee8d
SHA1

325984064a90f099e4d603c43ee89efaedc20e3a
SHA256

6822eb265957868141766320208c08ad85875bf85498eb176ecfd860907682b6
SHA512

22bb16d168760f40320e66f5c9222fb3dc798c9858699c4dcd293e2ec9380b964ca8d67cf3a95526e165f2dfa7fff8b5487653bdf00a36ce55ead9ceb5041178
SSDEEP

3072:Tv8PlwZEGazF9YS55qm1bBIqY8iR/sgwcKa2gQRjpp:4+ZwhtIBVuI7MFp

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2000 wrote to memory of 1660	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 1660	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 1660	2000	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\夢魔个人远控GHOST+.3.78美化版\MP3Enc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\夢魔个人远控GHOST+.3.78美化版\MP3Enc.dll,#1
2⤵
PID:1660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1660-132-0x0000000000000000-mapping.dmp

Download
memory/1660-134-0x0000000010000000-0x00000000100CE000-memory.dmp

Filesize
824KB

Download
memory/1660-133-0x0000000010000000-0x00000000100CE000-memory.dmp

Filesize
824KB

Download