9e4330c26a27910b5713211ae3bf5a93c20e00bedb60c0f63e773cebd48ec9c6 | Triage

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 06:40

Sharing

Report Analysis Logs

General

Target

免费版/NiniWeb.dll
Size

640KB
MD5

ed55f2a3d24823be12c67b891a8507a9
SHA1

1d0ea766ec67db7804e0f03efbbe74ba3fe94140
SHA256

68cd163dcc1fd1120c33a6ea6cd7f56d70c6f0a189a4d1e4ebdd62638079d1b4
SHA512

6c873b3751f1f92a2ad6ac8d9be75c2a49ff8f73f1187c075b21cc86f4719610ece28f72f9661fbe912419be6d1e9316e7fca8497cde6ecafe351ac6ab2a0279
SSDEEP

12288:xOIYOFpKC+vMq1U5tp+2phYZq1BpgDJMXyQy:cigDVQy

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2984	2124	rundll32.exe	21
PID 2124 wrote to memory of 2984	2124	rundll32.exe	21
PID 2124 wrote to memory of 2984	2124	rundll32.exe	21
PID 2124 wrote to memory of 2984	2124	rundll32.exe	21
PID 2124 wrote to memory of 2984	2124	rundll32.exe	21
PID 2124 wrote to memory of 2984	2124	rundll32.exe	21
PID 2124 wrote to memory of 2984	2124	rundll32.exe	21

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\免费版\NiniWeb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\免费版\NiniWeb.dll,#1
  2⤵
  PID:2984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads