Analysis
-
max time kernel
96s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2023 16:02
Static task
static1
Behavioral task
behavioral1
Sample
ƽ&ַʥ100Ԫĵ/˵/.res/ProcComm.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
ƽ&ַʥ100Ԫĵ/˵/.res/ProcComm.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
ƽ&ַʥ100Ԫĵ/˵/.res/wps.scr
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
ƽ&ַʥ100Ԫĵ/˵/.res/wps.scr
Resource
win10v2004-20231222-en
Behavioral task
behavioral5
Sample
ƽ&ַʥ100Ԫĵ/˵/�.docx
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
ƽ&ַʥ100Ԫĵ/˵/�.docx
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
ƽ&ַʥ100Ԫĵ/ƽ��.lnk
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
ƽ&ַʥ100Ԫĵ/ƽ��.lnk
Resource
win10v2004-20231215-en
General
-
Target
ƽ&ַʥ100Ԫĵ/˵/.res/ProcComm.dll
-
Size
1.1MB
-
MD5
b2a1a796fb8a33b051ae560d30b74e8e
-
SHA1
b06f169055605ff9faec3545e36eeccfa22da42a
-
SHA256
05176ca81fdcc507b4fb1de01f56234a5370a730e2c2187bf3e6da3df9a9ac29
-
SHA512
b77ed9cc349e6e417ba6c55828f9a595972d5f9014a0d349e4e3e43453b378f5c239eeb3b4e8ebf0090c2b79f5632a604280c41d707a773a4fb9e3f17cff5269
-
SSDEEP
24576:cMaCIDDHcXbZ+chP+Rur0Driyhpuec/iSXhAfqowx:daCGHYd2Duy1
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 404 wrote to memory of 1036 404 rundll32.exe rundll32.exe PID 404 wrote to memory of 1036 404 rundll32.exe rundll32.exe PID 404 wrote to memory of 1036 404 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ƽ&ַʥ100Ԫĵ\˵\.res\ProcComm.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ƽ&ַʥ100Ԫĵ\˵\.res\ProcComm.dll,#12⤵PID:1036