0123418ffeceaec339159113651a7f2bb502b64b25a34d812b27ff88e1e53db3 | Triage

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 07:18

Sharing

Report Analysis Logs

General

Target

明月11.79/CDload.dll
Size

92KB
MD5

b7b04e78799269eb6ae07242efc43c69
SHA1

e580b938475370270a5c3068669f23cf717a8c92
SHA256

086ba32e43977b507a65a78a74a15ee6f23ed961598b73e2c6997896249a46b2
SHA512

0a1ba08439e660b011135b3f3591ddfa5575261a2bd9620f8a0f3e3c041ca3667e1e0850b49c8275f6c9877cce3a53208db2338ff47fa10bf694d4a07ca7c515
SSDEEP

1536:Kj01IgN9qSsxZCMd4J9529W4dWB8zI0rfub:S/W9qPCxYdxWb

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4968 wrote to memory of 4920	4968	rundll32.exe	rundll32.exe
PID 4968 wrote to memory of 4920	4968	rundll32.exe	rundll32.exe
PID 4968 wrote to memory of 4920	4968	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\明月11.79\CDload.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\明月11.79\CDload.dll,#1
  2⤵
  PID:4920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4920-132-0x0000000000000000-mapping.dmp

Download