80a1fd1ece493f72a864f3e60d1ea43e503b27a11a9d18234ec398337c574aaa | Triage

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 05:47

Sharing

Report Analysis Logs

General

Target

QQռ˵˵ɾ/krnln.dll
Size

1.0MB
MD5

74c79231960067787b2acbdf5a851ed7
SHA1

619c5536fdb6a22c0164237374edb016ab2bed2e
SHA256

3585a5d1a84d1f8212009b80b26aff3b7d0643f35626324af38c3d72443c66c4
SHA512

dcf8cc1730a3f2fa65ecfbf6626e63b772e95f708c582372acc3abb61dad578070c109a4b48b441a3094c326fd35e4527751909210d509ff3f9b4ce7e533d259
SSDEEP

12288:/5FuSWj2rWwLL8GdK7euRJ9w8+xoskvH4YseOFesIzePFUUgIb4vx:/W1FcZdK78y4qzePFUX

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 1332	1080	rundll32.exe	28
PID 1080 wrote to memory of 1332	1080	rundll32.exe	28
PID 1080 wrote to memory of 1332	1080	rundll32.exe	28
PID 1080 wrote to memory of 1332	1080	rundll32.exe	28
PID 1080 wrote to memory of 1332	1080	rundll32.exe	28
PID 1080 wrote to memory of 1332	1080	rundll32.exe	28
PID 1080 wrote to memory of 1332	1080	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQռ˵˵ɾ\krnln.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQռ˵˵ɾ\krnln.dll,#1
  2⤵
  PID:1332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1332-55-0x0000000074ED1000-0x0000000074ED3000-memory.dmp

Filesize
8KB

Download