53d8cfe1f7ea99fff9531f5b608fc2b57ab24837b348ca6aa4b75ad945999291 | Triage

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2024 03:22

Sharing

Report Analysis Logs

General

Target

梦幻法宝/jlyy.dll
Size

740KB
MD5

9babfeb008d949f69db9199c11b44bbb
SHA1

1ab7e20427c541fc1d1e4ad00e7c45476cf73bf5
SHA256

ca6a3f277077ba19f61925861ac1287f2e072e2d0aa1c75a85b46d11a1271c41
SHA512

15369ec519439983fba3bd6d128dd3c7721ad3215e734e2c88c9b5f8c51271531d8bad4170d6ad448bd15df6c936fce6f9fec288efaa5954e87b8cab20ec31cb
SSDEEP

12288:ACVLTCbmHVV1HFDYan6T3I28tFkHDQ70adyET2V:AOTCbqrHFDjQ3P8tFkHDQ7iET2V

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 3752	5056	rundll32.exe	85
PID 5056 wrote to memory of 3752	5056	rundll32.exe	85
PID 5056 wrote to memory of 3752	5056	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\梦幻法宝\jlyy.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\梦幻法宝\jlyy.dll,#1
  2⤵
  PID:3752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads