Analysis
-
max time kernel
47s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 19:05
Behavioral task
behavioral1
Sample
51新炫舞挂房V喊话器[免费]/dm.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
51新炫舞挂房V喊话器[免费]/dm.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
51新炫舞挂房V喊话器[免费]/使用必读.url
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
51新炫舞挂房V喊话器[免费]/使用必读.url
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
51新炫舞挂房V喊话器[免费]/挂房+喊话器[免费].exe
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
51新炫舞挂房V喊话器[免费]/挂房+喊话器[免费].exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
51新炫舞挂房V喊话器[免费]/绿色先锋下载.url
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
51新炫舞挂房V喊话器[免费]/绿色先锋下载.url
Resource
win10v2004-20221111-en
General
-
Target
51新炫舞挂房V喊话器[免费]/dm.dll
-
Size
816KB
-
MD5
583c06c7b8167d0c1ddd307bd92701b9
-
SHA1
da3fb90d46c8e2ecb9c60c5c8c2b258a586f1cb4
-
SHA256
b1b401c604f58249e268655aea88092b16f0f7806fafdbffb4e3ce0e3be27f17
-
SHA512
39044dfa676e6f801c3686c41738ab589b8db8e6eef1d3db58031be6bfcbfd3d5ff75e517ae4419f09f40094a092c2701b98e883da12cb1df044b2229b62da0f
-
SSDEEP
24576:QQgsGEuPrVSu8dMgerKeP01MqflXUkoz2:fgvp3OuYMqfp8
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/956-57-0x0000000010000000-0x00000000101A7000-memory.dmp upx -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 960 wrote to memory of 956 960 regsvr32.exe regsvr32.exe PID 960 wrote to memory of 956 960 regsvr32.exe regsvr32.exe PID 960 wrote to memory of 956 960 regsvr32.exe regsvr32.exe PID 960 wrote to memory of 956 960 regsvr32.exe regsvr32.exe PID 960 wrote to memory of 956 960 regsvr32.exe regsvr32.exe PID 960 wrote to memory of 956 960 regsvr32.exe regsvr32.exe PID 960 wrote to memory of 956 960 regsvr32.exe regsvr32.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/956-55-0x0000000000000000-mapping.dmp
-
memory/956-56-0x00000000757A1000-0x00000000757A3000-memory.dmpFilesize
8KB
-
memory/956-57-0x0000000010000000-0x00000000101A7000-memory.dmpFilesize
1.7MB
-
memory/960-54-0x000007FEFC011000-0x000007FEFC013000-memory.dmpFilesize
8KB