7f4af8bf6568d684df93719bb2c64588ac3117885f07bdb7c46ce1d981a71013 | Triage

Analysis

max time kernel
167s
max time network
202s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 01:14

Sharing

Report Analysis Logs

General

Target

数码照片管理系统(发布)/RICHED20.dll
Size

512KB
MD5

6b53c96b13b4295f4758efc8f36faf5c
SHA1

313ba16c49717bd0eb6aac999b06f20704e2e594
SHA256

68b490d6b4fb2bef33cbe9cc9467829b05896e91e1399a59d55b285ece3167cf
SHA512

297997830ce3127b74a87600ee91e941d1e11dafc837734a37f56274ff09d7542aaeced5d360b026af1c702b9842100f279491211e4c0e08f73921d0622f041f
SSDEEP

12288:k5wqDfTAI4uA7r7guhxBmbe1c1Strzj3MLSm/YrKhJXqo:k+M7AI4uATgu9SWrHJm/vF

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 2704	4904	rundll32.exe	95
PID 4904 wrote to memory of 2704	4904	rundll32.exe	95
PID 4904 wrote to memory of 2704	4904	rundll32.exe	95

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\数码照片管理系统(发布)\RICHED20.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\数码照片管理系统(发布)\RICHED20.dll,#1
  2⤵
  PID:2704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5420 --field-trial-handle=2256,i,9172343514068348080,519219714517961765,262144 --variations-seed-version /prefetch:8
1⤵
PID:220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads