2a7bb07da52430c6aa6871dece4ad4a75938e44dd587bacee77f8b929d4bbcdf | Triage

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 11:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

QQ超级农民/xplib.dll
Size

48KB
MD5

37a58e1c5ce48e401ee8dd1d1da54814
SHA1

a87d00d78838c2d968b72330ee6f21f69b2caae5
SHA256

1c426928fb90bedb31fcffa0f3fbe7bdbca4259f93f5abdefed6a9a089f2982c
SHA512

e85052fc305040bdcaf47262e0ce6eef0848b319baac72a076dc94e7d20ea7ad8fbdd7d5381606a3154ab84fe81429bb339123ac1cd94551b1dc9cecfb7a08bf
SSDEEP

768:95ehgMIJq5cvheK4dw7HCDyTS1fXdeZeNgaH+1ox+vd4:95ebI4qvA9yTS5X6m2o

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 1428	4780	rundll32.exe	88
PID 4780 wrote to memory of 1428	4780	rundll32.exe	88
PID 4780 wrote to memory of 1428	4780	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQ超级农民\xplib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQ超级农民\xplib.dll,#1
  2⤵
  PID:1428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads