a490e2d404c0a5a566b63994d94b5bcc29388c8304be35dca6e473327b74ea46 | Triage

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-03-2024 14:12

Sharing

Report Analysis Logs

General

Target

gen_yqllyrics.dll
Size

52KB
MD5

f811ae048d4c047327ed7e595910436a
SHA1

64ca166e6c5f004811aaf1f7947cbc98eb237e1f
SHA256

5d4e90ebdf0c5bc432752d0472950da456a32f097a029b42258a2687d67f9cad
SHA512

46dc4b8faee0466c5f28359aee1665d0a76e9bda6bf2365b3100a2d89855b07f88f3014950a0f33a3e895e75a6a344991e6e969e9349105f1af181954f340f6c
SSDEEP

768:3jzanFsHu9d+PN/qgR6UA8Omzaa9JZtltVtKYUqw9:3j6FLaz287zamztKYUqw

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1784 wrote to memory of 2784	1784	rundll32.exe	rundll32.exe
PID 1784 wrote to memory of 2784	1784	rundll32.exe	rundll32.exe
PID 1784 wrote to memory of 2784	1784	rundll32.exe	rundll32.exe
PID 1784 wrote to memory of 2784	1784	rundll32.exe	rundll32.exe
PID 1784 wrote to memory of 2784	1784	rundll32.exe	rundll32.exe
PID 1784 wrote to memory of 2784	1784	rundll32.exe	rundll32.exe
PID 1784 wrote to memory of 2784	1784	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gen_yqllyrics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1784

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gen_yqllyrics.dll,#1
2⤵
PID:2784

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...