571fdba3497a39c7a202753e671f5002323a302d895a8d1862419622953e1c6a | Triage

Analysis

max time kernel
177s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 22:06

Sharing

Report Analysis Logs

General

Target

雷霆之怒夜涩辅助V2.3/EThread.dll
Size

56KB
MD5

391a5e311cebf461334acb330a0faaf8
SHA1

8e46d3ac91ba123803d69a665c80b30f5a8ad339
SHA256

8f462850ca8f46dd4095097aac4fcfb04cfd7fb0020f410dd3612960a16cd054
SHA512

8e7bc8c3677c6afcedb6fe7c6f4aa7ab9097ecb015012e734c58d59d6b77a04ef12a32dc653e6e06c332c4bdb50cc5c986eb07b44a4203f9512dd168a289ecc8
SSDEEP

768:13gWNW3gyVNWTmOPMJcyS6K7viaViB9V5yHQ6Fq4oCaJaUOJK:5XkSTmOP0Cbu2BboCakJK

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4640 wrote to memory of 4892	4640	rundll32.exe	rundll32.exe
PID 4640 wrote to memory of 4892	4640	rundll32.exe	rundll32.exe
PID 4640 wrote to memory of 4892	4640	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\雷霆之怒夜涩辅助V2.3\EThread.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4640

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\雷霆之怒夜涩辅助V2.3\EThread.dll,#1
2⤵
PID:4892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4892-132-0x0000000000000000-mapping.dmp

Download