8272912ee1bf16a05192042253c37356e5944c0e26795772a14c606565ca58b6 | Triage

Analysis

max time kernel
240s
max time network
288s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 09:05

Sharing

Report Analysis Logs

General

Target

YY5331过非法VE/emptydll.dll
Size

17KB
MD5

86ab9d6421450072c6352e4d1fc4162b
SHA1

685157eb4b3e4c4cc5c9b85a21bf5d08d4df4048
SHA256

51422b02981a2e6c621004933a15d410787bbf2da9e6cdce94a01c7b6564aa87
SHA512

f90c0ff42f3c1668777c82ee2e78cea613ec7d8d41e828c2c23c61fc292fc55d59cae675608a66f60220186cb9a8841b8c033d079e01cd9232b6e184fb0f7c90
SSDEEP

384:kb0ILrmjPOpA8Z/ij7m+1Ir9QCJHBAWy/I2RU7OtNzcCl:DIPppFZ/ija+1I5ZmnAfkr

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 2880	748	rundll32.exe	27
PID 748 wrote to memory of 2880	748	rundll32.exe	27
PID 748 wrote to memory of 2880	748	rundll32.exe	27
PID 748 wrote to memory of 2880	748	rundll32.exe	27
PID 748 wrote to memory of 2880	748	rundll32.exe	27
PID 748 wrote to memory of 2880	748	rundll32.exe	27
PID 748 wrote to memory of 2880	748	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\YY5331过非法VE\emptydll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\YY5331过非法VE\emptydll.dll,#1
  2⤵
  PID:2880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads