51a9c6273d15a03c8cf9a75d9f25c9b1a094c8fc7ec2bd2654032f6dfad9c061 | Triage

Analysis

max time kernel
184s
max time network
196s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 00:00

Sharing

Report Analysis Logs

General

Target

零操作学校音乐铃声软件/XTRAS/WMFVIEW.dll
Size

37KB
MD5

76cd1562593e6f5f7e5084da8a9db637
SHA1

bbff838e2227044b830a12adaf8efa8609cb5fd2
SHA256

ac3d3fe5529b73f2d128042dd174a03f2dee8d77a3043198a1a04d6cd5b5c279
SHA512

5dd0cb09c042a8eaa76b996d0ad814987688009e23f5cfbbb092fbc6ededf38a7e5133b5dff4f34854b5f9bd5af5355e2714d87c3cd6916d1db48f888f7a84a2
SSDEEP

768:/ze/kGxp0Q/jonWZ4e6aPCrLVKzuBtnLRMZEofK:S/k0puWZR6aoLVXBtnFMdK

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 4756	1596	rundll32.exe	85
PID 1596 wrote to memory of 4756	1596	rundll32.exe	85
PID 1596 wrote to memory of 4756	1596	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\零操作学校音乐铃声软件\XTRAS\WMFVIEW.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\零操作学校音乐铃声软件\XTRAS\WMFVIEW.dll,#1
  2⤵
  PID:4756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads