2a7bb07da52430c6aa6871dece4ad4a75938e44dd587bacee77f8b929d4bbcdf | Triage

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 11:54

Sharing

Report Analysis Logs

General

Target

QQ超级农民/iext.dll
Size

216KB
MD5

cba933625bfa502fc4a1d9f34e1e4473
SHA1

5319194388c0e53321f99f1541b97af191999a09
SHA256

25549c7781b3f1b92e73b0ea721d177207cce914a66f3229a71291f2eb160013
SHA512

f5fb4b97c4f68a20e0847e6528740ce659c4501726f3b2dff1ac83e88a3b7198099da03edb0f069cd4af7ed568a2373597b235cd239895addfa5226d3a444142
SSDEEP

3072:1dh+NmslaQ7iAvBvXo8M360VVQrtPdDMDyowHhRJl5pnR:iiGK8M36zVdRL

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 3512	4984	rundll32.exe	87
PID 4984 wrote to memory of 3512	4984	rundll32.exe	87
PID 4984 wrote to memory of 3512	4984	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQ超级农民\iext.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQ超级农民\iext.dll,#1
  2⤵
  PID:3512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads