16e82bd509cf326cc7b3239459f80196bdde1fb15cad21e03e48189e4e73f857 | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
21-04-2024 16:08

Sharing

Report Analysis Logs

General

Target

taobao_qunfa_5.70/iext.dll
Size

216KB
MD5

cba933625bfa502fc4a1d9f34e1e4473
SHA1

5319194388c0e53321f99f1541b97af191999a09
SHA256

25549c7781b3f1b92e73b0ea721d177207cce914a66f3229a71291f2eb160013
SHA512

f5fb4b97c4f68a20e0847e6528740ce659c4501726f3b2dff1ac83e88a3b7198099da03edb0f069cd4af7ed568a2373597b235cd239895addfa5226d3a444142
SSDEEP

3072:1dh+NmslaQ7iAvBvXo8M360VVQrtPdDMDyowHhRJl5pnR:iiGK8M36zVdRL

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2944 wrote to memory of 2976	2944	rundll32.exe	rundll32.exe
PID 2944 wrote to memory of 2976	2944	rundll32.exe	rundll32.exe
PID 2944 wrote to memory of 2976	2944	rundll32.exe	rundll32.exe
PID 2944 wrote to memory of 2976	2944	rundll32.exe	rundll32.exe
PID 2944 wrote to memory of 2976	2944	rundll32.exe	rundll32.exe
PID 2944 wrote to memory of 2976	2944	rundll32.exe	rundll32.exe
PID 2944 wrote to memory of 2976	2944	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\taobao_qunfa_5.70\iext.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2944

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\taobao_qunfa_5.70\iext.dll,#1
2⤵
PID:2976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads