16e82bd509cf326cc7b3239459f80196bdde1fb15cad21e03e48189e4e73f857 | Triage

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21-04-2024 16:08

Sharing

Report Analysis Logs

General

Target

taobao_qunfa_5.70/iconv.dll
Size

912KB
MD5

fd91dbcca49f02a8324e0fefd651ac57
SHA1

209a45f9966da85bc93dfa613d80e00071223784
SHA256

5921b2d83133f048bd34dd30bfcb2986bc8f08675a02defe8e43c3f978e76bd9
SHA512

b3b8bdd71f384956d3523a313f2658c9a2e9e979133bc2a027323791c3d97f39d63a37308fa63503584304d4078dea442012285b1ae37df45276cb20f1a2b8ff
SSDEEP

24576:lDBf2FfWl8KuqGavkg3NyNIbbbIoIBAUZLY:lB+s8KuqGaX0ToIBAUZLY

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5020 wrote to memory of 4288	5020	rundll32.exe	rundll32.exe
PID 5020 wrote to memory of 4288	5020	rundll32.exe	rundll32.exe
PID 5020 wrote to memory of 4288	5020	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\taobao_qunfa_5.70\iconv.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5020

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\taobao_qunfa_5.70\iconv.dll,#1
2⤵
PID:4288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads