bf176a4b8c3cec298fe69a631aca88f9ebf3a9757d53d9ca49e1ad0bf2d8a0e9 | Triage

Analysis

max time kernel
29s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 04:54

Sharing

Report Analysis Logs

General

Target

急速辅助免费版1223/前锋加速器1.6/iext2.dll
Size

492KB
MD5

d20cd238d4a70eb0b9adceade47bb65b
SHA1

cbe38ce78a75b4a2b83c99874054aa11d034ba8f
SHA256

6b3918dc8505625b1863379c1761c356d5fc19b5c51cd097260f3e90894dee26
SHA512

e5fa7670ce18bfe189fd1631091977797223ab41dbf91e051fd6f2bf9b9dcce289904549075ac07263fdbcb0911d118118112f6bb0de2cbe31fd794ea68ca196
SSDEEP

12288:HOTSbGbeNeoPMT+BWamiZxq/aml7QUYJDQCp7:uGS8eoMiZxdmlY1QC

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1944 wrote to memory of 1936	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 1936	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 1936	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 1936	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 1936	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 1936	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 1936	1944	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\急速辅助免费版1223\前锋加速器1.6\iext2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1944

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\急速辅助免费版1223\前锋加速器1.6\iext2.dll,#1
2⤵
PID:1936

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1936-54-0x0000000000000000-mapping.dmp

Download
memory/1936-55-0x0000000076D71000-0x0000000076D73000-memory.dmp

Filesize
8KB

Download