Overview
overview
10Static
static
10冰封免�...m2.dll
windows7-x64
8冰封免�...m2.dll
windows10-2004-x64
8冰封免�...ar.dll
windows7-x64
3冰封免�...ar.dll
windows10-2004-x64
3冰封免�...ll.dll
windows7-x64
1冰封免�...ll.dll
windows10-2004-x64
1冰封免�...fo.dll
windows7-x64
1冰封免�...fo.dll
windows10-2004-x64
3冰封免�...ua.dll
windows7-x64
3冰封免�...ua.dll
windows10-2004-x64
3冰封免�...om.exe
windows7-x64
6冰封免�...om.exe
windows10-2004-x64
6冰封免�...om.dll
windows7-x64
1冰封免�...om.dll
windows10-2004-x64
1冰封免�...jx.dll
windows7-x64
3冰封免�...jx.dll
windows10-2004-x64
1冰封免�...ky.dll
windows7-x64
1冰封免�...ky.dll
windows10-2004-x64
1冰封免�...ty.exe
windows7-x64
5冰封免�...ty.exe
windows10-2004-x64
5冰封免�...ty.dll
windows7-x64
1冰封免�...ty.dll
windows10-2004-x64
1冰封免�...te.exe
windows7-x64
8冰封免�...te.exe
windows10-2004-x64
8冰封免�...ws.dll
windows7-x64
1冰封免�...ws.dll
windows10-2004-x64
1冰封免�...ip.exe
windows7-x64
8冰封免�...ip.exe
windows10-2004-x64
8冰封免�...��.url
windows7-x64
1冰封免�...��.url
windows10-2004-x64
1冰封免�...��.url
windows7-x64
1冰封免�...��.url
windows10-2004-x64
1Analysis
-
max time kernel
28s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 18:37
Behavioral task
behavioral1
Sample
冰封免费版(请关闭杀毒软件下载)/3km2.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
冰封免费版(请关闭杀毒软件下载)/3km2.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
冰封免费版(请关闭杀毒软件下载)/Astar.dll
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
冰封免费版(请关闭杀毒软件下载)/Astar.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
冰封免费版(请关闭杀毒软件下载)/Dll.dll
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
冰封免费版(请关闭杀毒软件下载)/Dll.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
冰封免费版(请关闭杀毒软件下载)/GetInfo.dll
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
冰封免费版(请关闭杀毒软件下载)/GetInfo.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
冰封免费版(请关闭杀毒软件下载)/Lua.dll
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
冰封免费版(请关闭杀毒软件下载)/Lua.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
冰封免费版(请关闭杀毒软件下载)/gom.exe
Resource
win7-20220901-en
Behavioral task
behavioral12
Sample
冰封免费版(请关闭杀毒软件下载)/gom.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral13
Sample
冰封免费版(请关闭杀毒软件下载)/gom.dll
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
冰封免费版(请关闭杀毒软件下载)/gom.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
冰封免费版(请关闭杀毒软件下载)/jx.dll
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
冰封免费版(请关闭杀毒软件下载)/jx.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral17
Sample
冰封免费版(请关闭杀毒软件下载)/sky.dll
Resource
win7-20221111-en
Behavioral task
behavioral18
Sample
冰封免费版(请关闭杀毒软件下载)/sky.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
冰封免费版(请关闭杀毒软件下载)/ty.exe
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
冰封免费版(请关闭杀毒软件下载)/ty.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral21
Sample
冰封免费版(请关闭杀毒软件下载)/ty.dll
Resource
win7-20221111-en
Behavioral task
behavioral22
Sample
冰封免费版(请关闭杀毒软件下载)/ty.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral23
Sample
冰封免费版(请关闭杀毒软件下载)/update.exe
Resource
win7-20221111-en
Behavioral task
behavioral24
Sample
冰封免费版(请关闭杀毒软件下载)/update.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral25
Sample
冰封免费版(请关闭杀毒软件下载)/ws.dll
Resource
win7-20220812-en
Behavioral task
behavioral26
Sample
冰封免费版(请关闭杀毒软件下载)/ws.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral27
Sample
冰封免费版(请关闭杀毒软件下载)/冰封vip.exe
Resource
win7-20220812-en
Behavioral task
behavioral28
Sample
冰封免费版(请关闭杀毒软件下载)/冰封vip.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
冰封免费版(请关闭杀毒软件下载)/冰封官方网站.url
Resource
win7-20221111-en
Behavioral task
behavioral30
Sample
冰封免费版(请关闭杀毒软件下载)/冰封官方网站.url
Resource
win10v2004-20221111-en
Behavioral task
behavioral31
Sample
冰封免费版(请关闭杀毒软件下载)/冰封教程,很全面点击打开.url
Resource
win7-20220812-en
Behavioral task
behavioral32
Sample
冰封免费版(请关闭杀毒软件下载)/冰封教程,很全面点击打开.url
Resource
win10v2004-20220812-en
General
-
Target
冰封免费版(请关闭杀毒软件下载)/Dll.dll
-
Size
7KB
-
MD5
0bbbca7038095d2ca8eff205bb1c7210
-
SHA1
af89fc4b2dfbfd0a0ce464a171c78009f7caf1b6
-
SHA256
3b4869d560062b4ea0edd78fba1d798a403b8749a9b32d323058e7e6416ee53e
-
SHA512
2870cbf3eb75b3812f502b6ab5adae543349b02eb8e62ec1531d0464c9d475e69d4a9e6773a237dc7616f5754ef255903d976cf7d7a5d55e5b2b5043112595d7
-
SSDEEP
96:yWf0YDrMtyjnyoSvDilH2tBOMrJQOBdFC+orPT3XAUPVAF6GDTnECt6M7N:5iy+o4DiwBOxO2rr3XHPV26Onf6A
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1648 wrote to memory of 608 1648 rundll32.exe rundll32.exe PID 1648 wrote to memory of 608 1648 rundll32.exe rundll32.exe PID 1648 wrote to memory of 608 1648 rundll32.exe rundll32.exe PID 1648 wrote to memory of 608 1648 rundll32.exe rundll32.exe PID 1648 wrote to memory of 608 1648 rundll32.exe rundll32.exe PID 1648 wrote to memory of 608 1648 rundll32.exe rundll32.exe PID 1648 wrote to memory of 608 1648 rundll32.exe rundll32.exe