80a1fd1ece493f72a864f3e60d1ea43e503b27a11a9d18234ec398337c574aaa | Triage

Analysis

max time kernel
116s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 05:47

Sharing

Report Analysis Logs

General

Target

QQռ˵˵ɾ/spec.dll
Size

88KB
MD5

84f73873ae5fa41a274bbe3333e705b3
SHA1

19767762255d8c9a1ecc42c662dd33b0ffc11f66
SHA256

5e44416130dc9c94522cbdf213742b6c66fef9a20c5276719f2f8a6333635c6b
SHA512

4aa270284935e15a69ebf7ada9e6653f2fcf0ade93383ced6de2c8cfe0140a20b242311a5f591fe2766a811b2cff6c568a34010ad599bede9c0ed034ee7d1a1a
SSDEEP

1536:3ohsQOBxOWxKT2HZaum0JPx5tAYz0Jfob2v9oIGRf:3ohip0TIsuXtGJfob

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 5072	3672	rundll32.exe	78
PID 3672 wrote to memory of 5072	3672	rundll32.exe	78
PID 3672 wrote to memory of 5072	3672	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQռ˵˵ɾ\spec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQռ˵˵ɾ\spec.dll,#1
  2⤵
  PID:5072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5072-133-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download
memory/5072-134-0x0000000002AC0000-0x0000000002BDA000-memory.dmp

Filesize
1.1MB

Download