4e45113bdfa91deb6cddf6579f40a2471ce152e3fb4b934ccae1a207a1cad724 | Triage

Analysis

max time kernel
154s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 08:41

Sharing

Report Analysis Logs

General

Target

变速精灵2.11免费版/cooperate/LiveUpdate.dll
Size

33KB
MD5

d94c93f3d142d8c5927ac1c6e5e89aa1
SHA1

09d486dc3871f961e488a2460f6312c7c46f2572
SHA256

e9cfba608c08dc2a0b965d9823e0179db547d88d439ad609edbb84e499c457ae
SHA512

3ca65deb628dfa60056f5184cf4a5df1aa49896dfddf8419c460374576360d8f6a62dc74a375915f1349286ce7bc603fcf46f7daa33b22e826247ed8d8dadb24
SSDEEP

768:KhgecrIHVGNXGbxNBlhmu9HnQ1y8IqRrxq6XJ5g:ccr+O2bxt4OIy8IqRtq655g

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2248	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3860 wrote to memory of 2248	3860	rundll32.exe	83
PID 3860 wrote to memory of 2248	3860	rundll32.exe	83
PID 3860 wrote to memory of 2248	3860	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\变速精灵2.11免费版\cooperate\LiveUpdate.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\变速精灵2.11免费版\cooperate\LiveUpdate.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2248

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2248-133-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/2248-134-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download