08ccc4452d1dee6da9362d6e0a91a0ee02842a1bddb679d2cb3c267cb8a4860f | Triage

Analysis

max time kernel
278s
max time network
397s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 09:07

Sharing

Report Analysis Logs

General

Target

928免杀远控/sock.dll
Size

60KB
MD5

698bd942f9334e0ab5d0c7002b13ed70
SHA1

58eb04593c14ccb0c3f703b35710faf05711465c
SHA256

9578922e34dfc8f3298e67dcaa5075d870dfdc4ef958985d5fc0e5e6b3849aa9
SHA512

e0c78360c55c31ec139e7a0d8b44e3702dc721c1ea66c9e5deb9fde2bd4122ba10012b67d0d614ecc665a68d9ceb0d8fc79d279f41e7390ef3fe2495901b7740
SSDEEP

768:Wo7bG/hX9OdejL8BK0BofPT/bz7IjG/OqhhItJ22uk8ao00O:C/hXIcjL8xufPT/bz5/OqMIYo0

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 580 wrote to memory of 1192	580	rundll32.exe	rundll32.exe
PID 580 wrote to memory of 1192	580	rundll32.exe	rundll32.exe
PID 580 wrote to memory of 1192	580	rundll32.exe	rundll32.exe
PID 580 wrote to memory of 1192	580	rundll32.exe	rundll32.exe
PID 580 wrote to memory of 1192	580	rundll32.exe	rundll32.exe
PID 580 wrote to memory of 1192	580	rundll32.exe	rundll32.exe
PID 580 wrote to memory of 1192	580	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\928免杀远控\sock.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\928免杀远控\sock.dll,#1
  2⤵
  PID:1192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1192-54-0x0000000000000000-mapping.dmp

Download
memory/1192-55-0x0000000075C11000-0x0000000075C13000-memory.dmp

Filesize
8KB

Download