4e45113bdfa91deb6cddf6579f40a2471ce152e3fb4b934ccae1a207a1cad724 | Triage

Analysis

max time kernel
80s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 08:41

Sharing

Report Analysis Logs

General

Target

变速精灵2.11免费版/WinIo.dll
Size

15KB
MD5

1ce499b54e1deed84c1a62dff2105a9a
SHA1

5751984224ffe297632fb2b75906aa19fc4a48f0
SHA256

fb86b916efdf214cdfac741b520c0317d553cf5f2645a7c4861a5192d92ce4b3
SHA512

d0ded5b7179bfe6850af9a725c95011366800bf98a0d304c0714ebea80943a4014f81d6a838fc1394ecbbfc2caab277bcea9c6c060037aff429dacf3f3c4733d
SSDEEP

192:WfsnKy6WkAjtF7aLf9aORgMegirRwq1F5fphIma+M/xq03gYTnb:WfsKY/aLf5iD3Vta/caT

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 2496	3444	rundll32.exe	79
PID 3444 wrote to memory of 2496	3444	rundll32.exe	79
PID 3444 wrote to memory of 2496	3444	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\变速精灵2.11免费版\WinIo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\变速精灵2.11免费版\WinIo.dll,#1
  2⤵
  PID:2496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2496-132-0x0000000000000000-mapping.dmp

Download