16e82bd509cf326cc7b3239459f80196bdde1fb15cad21e03e48189e4e73f857 | Triage

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-04-2024 16:08

Sharing

Report Analysis Logs

General

Target

taobao_qunfa_5.70/iext3.dll
Size

380KB
MD5

07f0db2727c8288cd2cf7c4cf352708d
SHA1

caf2d1b631c785c1f6f01189cf841fc2661666ed
SHA256

3c18183857979a2b5664d3f852f74e3f31f0626720654914453e964938e18f5e
SHA512

b81029a2968663a180feca2e3e47f4736f87a7cc73e6a9153aa227b91d963e077f44c5a289b9f64d6b481b7bd5ccb4bcb762048a4f29810c1f4fd4e6106cb0d3
SSDEEP

6144:Vo6VHgv+N/mcNwbv+QoF6QgTwZxLYROrHS8DYIcRQXZR:VLhQQ6bvacwZxLYRr8DY5QXZR

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1432 wrote to memory of 2612	1432	rundll32.exe	rundll32.exe
PID 1432 wrote to memory of 2612	1432	rundll32.exe	rundll32.exe
PID 1432 wrote to memory of 2612	1432	rundll32.exe	rundll32.exe
PID 1432 wrote to memory of 2612	1432	rundll32.exe	rundll32.exe
PID 1432 wrote to memory of 2612	1432	rundll32.exe	rundll32.exe
PID 1432 wrote to memory of 2612	1432	rundll32.exe	rundll32.exe
PID 1432 wrote to memory of 2612	1432	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\taobao_qunfa_5.70\iext3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1432

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\taobao_qunfa_5.70\iext3.dll,#1
2⤵
PID:2612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads