08ccc4452d1dee6da9362d6e0a91a0ee02842a1bddb679d2cb3c267cb8a4860f | Triage

Analysis

max time kernel
48s
max time network
140s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 09:07

Sharing

Report Analysis Logs

General

Target

928免杀远控/commobj.dll
Size

112KB
MD5

2b86ad8cd1903916ae5a3cd7ec2f1b9e
SHA1

0240b4f0795ed3bf24748954fee6751901f26f2c
SHA256

590c9ba4cad5a401c071f89f8468c45031a637f1c137ca320d9dbe82e4beabd6
SHA512

517656179b727928d875f0ead1e986d8ad19711ec332143fdbc7684d1fd75ac728fa5495f89e4914dbaf2722a584cd6c33c1c9b406cd22f052cec94b7eb2395c
SSDEEP

1536:2ZfD10oHdhZJPaRTmvmT10JDoHB/zjeDJGuPu8oiv2hC:mXhfAaP6/9uW8oivU

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1328 wrote to memory of 1196	1328	rundll32.exe	rundll32.exe
PID 1328 wrote to memory of 1196	1328	rundll32.exe	rundll32.exe
PID 1328 wrote to memory of 1196	1328	rundll32.exe	rundll32.exe
PID 1328 wrote to memory of 1196	1328	rundll32.exe	rundll32.exe
PID 1328 wrote to memory of 1196	1328	rundll32.exe	rundll32.exe
PID 1328 wrote to memory of 1196	1328	rundll32.exe	rundll32.exe
PID 1328 wrote to memory of 1196	1328	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\928免杀远控\commobj.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\928免杀远控\commobj.dll,#1
  2⤵
  PID:1196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1196-54-0x0000000000000000-mapping.dmp

Download
memory/1196-55-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download