62b74a688d22bfdf20f673a351580029d7b9de67c6facc9a5613b22b3f798968 | Triage

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2023, 16:50

Sharing

Report Analysis Logs

General

Target

zh-Hans/Shadowsocks.resources.dll
Size

5KB
MD5

3888d2bc5601ed781f286fd5f0a0f80c
SHA1

e2417718bc1e8e20645c6a2cfceee300bb26b7bb
SHA256

36c769006ce4afbf877a34fdb6f5d09702e5d61231467b92c971d1d5dd92452a
SHA512

c3ad505a37d71cdb4ee27d21fa20c22588c9e48a8fe32523514de4ecc24b2472259275f91bb3bad55194222f033eae79c788f97805bbb2f88380e8fb621cb08d
SSDEEP

96:s20GS/MM1VImwwZRerUbDGmQxJ+KlP4uS+sf:s3Gbi2gKyu8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3888 wrote to memory of 4996	3888	rundll32.exe	64
PID 3888 wrote to memory of 4996	3888	rundll32.exe	64
PID 3888 wrote to memory of 4996	3888	rundll32.exe	64

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\zh-Hans\Shadowsocks.resources.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\zh-Hans\Shadowsocks.resources.dll,#1
  2⤵
  PID:4996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads