16e82bd509cf326cc7b3239459f80196bdde1fb15cad21e03e48189e4e73f857 | Triage

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21-04-2024 16:08

Sharing

Report Analysis Logs

General

Target

taobao_qunfa_5.70/isapi.dll
Size

116KB
MD5

1da9d2adac559af706650354128e4b9a
SHA1

7c441e0cd3d658fd9e82dd15dbd1506a9ade7c7a
SHA256

0986d450c863f0d73d3956e450e373db1504aabaa31c6455d9b45035e68174cc
SHA512

bd44317879a2a653ae98a978cc1b338f4133ae5e02c2ecd1b29b99e8802c8b79dbefa2ff8517204ee827083e25de366aaa3a4a2c89897c8e7d4a828310e248c4
SSDEEP

3072:v8+x8P5/EXaBOYsrsDTcYGMxomiOJIBRn:E+x8yXIsr4wnOJIPn

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2956 wrote to memory of 744	2956	rundll32.exe	rundll32.exe
PID 2956 wrote to memory of 744	2956	rundll32.exe	rundll32.exe
PID 2956 wrote to memory of 744	2956	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\taobao_qunfa_5.70\isapi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2956

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\taobao_qunfa_5.70\isapi.dll,#1
2⤵
PID:744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...