571fdba3497a39c7a202753e671f5002323a302d895a8d1862419622953e1c6a | Triage

Analysis

max time kernel
17s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 22:06

Sharing

Report Analysis Logs

General

Target

雷霆之怒夜涩辅助V2.3/internet.dll
Size

188KB
MD5

b925098c6a6330410cffb3994ef36211
SHA1

7467bb63d47ea2fa6dbf3984ede8d9e04b8ce37a
SHA256

f25727ce196ac0ab4119ab7968cdfe18425170b55012fc7fb26a3f824514d82f
SHA512

955ab8e3eb661cf575db0db77ca81fca16cdb3e29ce49237b1df1377d6f2aaff3c6a12bbc98a720f0a67292b39451474b97de31f696688a93547181991fffe0e
SSDEEP

3072:tpTEys+TR7yRoHzXjlhvtcxVIThpEbbAKNXoqlSY9M02MHUP:tpTEt+ycLHlCIThpEX9+XM

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1940 wrote to memory of 1492	1940	rundll32.exe	rundll32.exe
PID 1940 wrote to memory of 1492	1940	rundll32.exe	rundll32.exe
PID 1940 wrote to memory of 1492	1940	rundll32.exe	rundll32.exe
PID 1940 wrote to memory of 1492	1940	rundll32.exe	rundll32.exe
PID 1940 wrote to memory of 1492	1940	rundll32.exe	rundll32.exe
PID 1940 wrote to memory of 1492	1940	rundll32.exe	rundll32.exe
PID 1940 wrote to memory of 1492	1940	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\雷霆之怒夜涩辅助V2.3\internet.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1940

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\雷霆之怒夜涩辅助V2.3\internet.dll,#1
2⤵
PID:1492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1492-54-0x0000000000000000-mapping.dmp

Download
memory/1492-55-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download