4e45113bdfa91deb6cddf6579f40a2471ce152e3fb4b934ccae1a207a1cad724 | Triage

Analysis

max time kernel
20s
max time network
106s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 08:41

Sharing

Report Analysis Logs

General

Target

变速精灵2.11免费版/PSAPI.dll
Size

17KB
MD5

b3d22a483875a61cb2060c7d518effc2
SHA1

d9bf5f0b6c1138281bb45e4cfebec2c4d9753fb2
SHA256

d88ad399f7dc2d4830e7af1be3bfbf45aaf75e309f0b6afd8a9c4025bf19930e
SHA512

3add04e7dc482bb4b1e72306fb55ebdbb1a8fccf5eb2d1513695e9046d754322117c145f7eb1b4785e556c466efec667c70c0a573f24c2e6c141ef324f9287fe
SSDEEP

384:P1ncyubrbVlgocG1FAt7PyrdORoGDrbgL5ZWZkYWO:POyyvVlV1FAt7PsdODbgLp

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 1336	1144	rundll32.exe	28
PID 1144 wrote to memory of 1336	1144	rundll32.exe	28
PID 1144 wrote to memory of 1336	1144	rundll32.exe	28
PID 1144 wrote to memory of 1336	1144	rundll32.exe	28
PID 1144 wrote to memory of 1336	1144	rundll32.exe	28
PID 1144 wrote to memory of 1336	1144	rundll32.exe	28
PID 1144 wrote to memory of 1336	1144	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\变速精灵2.11免费版\PSAPI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\变速精灵2.11免费版\PSAPI.dll,#1
  2⤵
  PID:1336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1336-55-0x0000000075F01000-0x0000000075F03000-memory.dmp

Filesize
8KB

Download