16e82bd509cf326cc7b3239459f80196bdde1fb15cad21e03e48189e4e73f857 | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-04-2024 16:08

Sharing

Report Analysis Logs

General

Target

taobao_qunfa_5.70/iext5.dll
Size

308KB
MD5

11f8542990ec449537dd87f7f49e6528
SHA1

efd9c254da181a81d906aceb7faae1329a74145c
SHA256

89719808d22fc10882ed463aec592dd6ff4da5a69a44e5ba2b06a7a2efc19135
SHA512

569d9379e1acdf546040583919f614f762bde73d8c98bb98155801c107fea0b73d95c554da506de522b881914dabdd792999105d91fb55699e3adc9af7185639
SSDEEP

6144:F6Vlj6c9MojKjv2iLoaGUJj6Z+v4Qk/2YFoGD:g/hKjA26oEdz

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2084 wrote to memory of 1628	2084	rundll32.exe	rundll32.exe
PID 2084 wrote to memory of 1628	2084	rundll32.exe	rundll32.exe
PID 2084 wrote to memory of 1628	2084	rundll32.exe	rundll32.exe
PID 2084 wrote to memory of 1628	2084	rundll32.exe	rundll32.exe
PID 2084 wrote to memory of 1628	2084	rundll32.exe	rundll32.exe
PID 2084 wrote to memory of 1628	2084	rundll32.exe	rundll32.exe
PID 2084 wrote to memory of 1628	2084	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\taobao_qunfa_5.70\iext5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2084

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\taobao_qunfa_5.70\iext5.dll,#1
2⤵
PID:1628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads