80a1fd1ece493f72a864f3e60d1ea43e503b27a11a9d18234ec398337c574aaa | Triage

Analysis

max time kernel
153s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 05:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

QQռ˵˵ɾ/krnln.dll
Size

1.0MB
MD5

74c79231960067787b2acbdf5a851ed7
SHA1

619c5536fdb6a22c0164237374edb016ab2bed2e
SHA256

3585a5d1a84d1f8212009b80b26aff3b7d0643f35626324af38c3d72443c66c4
SHA512

dcf8cc1730a3f2fa65ecfbf6626e63b772e95f708c582372acc3abb61dad578070c109a4b48b441a3094c326fd35e4527751909210d509ff3f9b4ce7e533d259
SSDEEP

12288:/5FuSWj2rWwLL8GdK7euRJ9w8+xoskvH4YseOFesIzePFUUgIb4vx:/W1FcZdK78y4qzePFUX

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 1224	1400	rundll32.exe	83
PID 1400 wrote to memory of 1224	1400	rundll32.exe	83
PID 1400 wrote to memory of 1224	1400	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQռ˵˵ɾ\krnln.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQռ˵˵ɾ\krnln.dll,#1
  2⤵
  PID:1224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads