909df004857e854a646328179d73a9738eec6b2eb559be3b0cd8d3c53b3dd29a | Triage

Analysis

max time kernel
147s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-03-2024 05:06

Sharing

Report Analysis Logs

General

Target

Fix/360wservice.dll
Size

193KB
MD5

c8de0666e974d2848865241b35255ae8
SHA1

1c4570b2936e2e289b3b4236b20d203dd8877090
SHA256

95db9688f9fa0d934fddc9b1097b5a3f3479a7a03bc6a092562db56fd3eb09b4
SHA512

c69bd4d68194e68c2000b10d5852fdf327b27e1dc7b2e0ba9e83b1ed3038147e49bec39bd93afc1a88a5a1f606e92e06563d39dcc291c26c22e06b5c68ebdd12
SSDEEP

3072:2VqcR25QBAhnxYzrWd8xMnmjJe4qPIb0MTBfJvusM04Ppmvz4Fn2:XcWy7jJe+b0MTBhvusMho

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 4816	5076	rundll32.exe	89
PID 5076 wrote to memory of 4816	5076	rundll32.exe	89
PID 5076 wrote to memory of 4816	5076	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fix\360wservice.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fix\360wservice.dll,#1
  2⤵
  PID:4816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads