b77c9868fe8283f2eff9cefc327b9f0625f9a75265235521a28c5940ee040450 | Triage

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 04:09

Sharing

Report Analysis Logs

General

Target

客户端工具/qtintf.dll
Size

1.4MB
MD5

d34300cfb98bd2619e446b8bdb25e1aa
SHA1

fdd993e2511d18d8bddd980789c39cd950a87edc
SHA256

e6e6abf4140fc36951c8147b5079726d67b15710a443f8801bff2b63c58f6a92
SHA512

599c7f137902d05ecad4ed3976ad358ec8cafbb54ce54ba2161f77ffe79e5d491f8eb194e690fb23120373627c6852fca1ea62ecb9ac289fd9c3f44425df84e1
SSDEEP

24576:w51IAcWiBByScq/MB3arAr6JYsbHB3d66wPtfRnoTMbcJbQbq8:a1HcWIlfrOlszj6abb5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2188	1968	rundll32.exe	28
PID 1968 wrote to memory of 2188	1968	rundll32.exe	28
PID 1968 wrote to memory of 2188	1968	rundll32.exe	28
PID 1968 wrote to memory of 2188	1968	rundll32.exe	28
PID 1968 wrote to memory of 2188	1968	rundll32.exe	28
PID 1968 wrote to memory of 2188	1968	rundll32.exe	28
PID 1968 wrote to memory of 2188	1968	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\客户端工具\qtintf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\客户端工具\qtintf.dll,#1
  2⤵
  PID:2188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2188-0-0x0000000002060000-0x000000000245E000-memory.dmp

Filesize
4.0MB

Download
memory/2188-1-0x0000000002060000-0x000000000245E000-memory.dmp

Filesize
4.0MB

Download