bf176a4b8c3cec298fe69a631aca88f9ebf3a9757d53d9ca49e1ad0bf2d8a0e9 | Triage

Analysis

max time kernel
28s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 04:54

Sharing

Report Analysis Logs

General

Target

急速辅助免费版1223/前锋加速器1.6/iext5.dll
Size

324KB
MD5

ee1ad04c3648e12ef6f981b942127e52
SHA1

0e11533b99544575e5d830405a892807edaf01f0
SHA256

3c8d6d9b00c99c01697715818d23e1b9c2e449361414799447a17ef5e468e3e5
SHA512

c3a507d9a9b0a48b812ada357848240b22af19594b38e119f64cbe672fd1964852e66fa0f1ce3ce9feba7602965b6a3bd45e1fd6fd1c34b2987a739a75a2be75
SSDEEP

6144:hu7Kw6Qst8xQiXB38xWembVkbQgRK1fGcHgA:hunQq8/mbVuKZ0

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1976 wrote to memory of 1952	1976	rundll32.exe	rundll32.exe
PID 1976 wrote to memory of 1952	1976	rundll32.exe	rundll32.exe
PID 1976 wrote to memory of 1952	1976	rundll32.exe	rundll32.exe
PID 1976 wrote to memory of 1952	1976	rundll32.exe	rundll32.exe
PID 1976 wrote to memory of 1952	1976	rundll32.exe	rundll32.exe
PID 1976 wrote to memory of 1952	1976	rundll32.exe	rundll32.exe
PID 1976 wrote to memory of 1952	1976	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\急速辅助免费版1223\前锋加速器1.6\iext5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\急速辅助免费版1223\前锋加速器1.6\iext5.dll,#1
2⤵
PID:1952

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1952-54-0x0000000000000000-mapping.dmp

Download
memory/1952-55-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download