0123418ffeceaec339159113651a7f2bb502b64b25a34d812b27ff88e1e53db3 | Triage

Analysis

max time kernel
119s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 07:18

Sharing

Report Analysis Logs

General

Target

明月11.79/wsbox.dll
Size

630KB
MD5

3c2454abce90428bc45749cdd266d3b4
SHA1

b1506fc7eb75e427655f2dd9d92c3d7a8e9d3de0
SHA256

354dd101eb1d3f7a8c2eb68b357bb9dd67936c8f23170af6b580ef0e18c43f64
SHA512

679786b8f2da3c06b1f62a06c12fc2fb8b57302dc1ce6d3e5c3cedc554450e3d21cc625a4d92128627d12973437ed7dc1ffaf610cf40e6cbffe85ddbd1cfc041
SSDEEP

12288:u3NBMO1GG2hNyCrlXhxFIbUr1jnnjomY9Pp/8W:u3bM74CrlXhYQrtns3ZV8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2016 wrote to memory of 2176	2016	rundll32.exe	rundll32.exe
PID 2016 wrote to memory of 2176	2016	rundll32.exe	rundll32.exe
PID 2016 wrote to memory of 2176	2016	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\明月11.79\wsbox.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\明月11.79\wsbox.dll,#1
  2⤵
  PID:2176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2176-132-0x0000000000000000-mapping.dmp

Download
memory/2176-133-0x0000000075160000-0x0000000075358000-memory.dmp

Filesize
2.0MB

Download
memory/2176-134-0x0000000075160000-0x0000000075358000-memory.dmp

Filesize
2.0MB

Download
memory/2176-136-0x0000000075160000-0x0000000075358000-memory.dmp

Filesize
2.0MB

Download