2a7bb07da52430c6aa6871dece4ad4a75938e44dd587bacee77f8b929d4bbcdf | Triage

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 11:54

Sharing

Report Analysis Logs

General

Target

QQ超级农民/script.dll
Size

152KB
MD5

4c36a56c52e92543c1553b5f6fdc6c29
SHA1

367af6b36e4017269833da2afae1e235de2a5f81
SHA256

f431015f2f4d04f44e21ae582c9d416718df3b24768f69b91e299bd47aae5258
SHA512

ad59057be70fc4f4e7320e60ce72993330c668964630918d5fc85cd008abbeb73c4ecc55be9f8c27ff6403d3826db85e4adbc94cfb665f302eba2624037b01ba
SSDEEP

3072:wI3tOR94YRPENd/satlu0ASyX8o2gOdE1aVpLi:BtvYjaO091dK

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2032	2252	rundll32.exe	28
PID 2252 wrote to memory of 2032	2252	rundll32.exe	28
PID 2252 wrote to memory of 2032	2252	rundll32.exe	28
PID 2252 wrote to memory of 2032	2252	rundll32.exe	28
PID 2252 wrote to memory of 2032	2252	rundll32.exe	28
PID 2252 wrote to memory of 2032	2252	rundll32.exe	28
PID 2252 wrote to memory of 2032	2252	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQ超级农民\script.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQ超级农民\script.dll,#1
  2⤵
  PID:2032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads