16e82bd509cf326cc7b3239459f80196bdde1fb15cad21e03e48189e4e73f857 | Triage

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-04-2024 16:08

Sharing

Report Analysis Logs

General

Target

taobao_qunfa_5.70/SkinH_EL.dll
Size

688KB
MD5

bd42ef63fc0f79fdaaeca95d62a96bbb
SHA1

97ca8ccb0e6f7ffeb05dc441b2427feb0b634033
SHA256

573cf4e4dfa8fe51fc8b80b79cd626cb861260d26b6e4f627841e11b4dce2f48
SHA512

431b5487003add16865538de428bf518046ee97ab6423d88f92cda4ff263f971c0cf3827049465b9288a219cc32698fd687939c7c648870dd7d8d6776735c93c
SSDEEP

12288:AuOtG9rMIfLpoTp2/WFH8bW7INLtK4dRjKCHd:9z9OIu4d1KCHd

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2756 wrote to memory of 2800	2756	rundll32.exe	rundll32.exe
PID 2756 wrote to memory of 2800	2756	rundll32.exe	rundll32.exe
PID 2756 wrote to memory of 2800	2756	rundll32.exe	rundll32.exe
PID 2756 wrote to memory of 2800	2756	rundll32.exe	rundll32.exe
PID 2756 wrote to memory of 2800	2756	rundll32.exe	rundll32.exe
PID 2756 wrote to memory of 2800	2756	rundll32.exe	rundll32.exe
PID 2756 wrote to memory of 2800	2756	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\taobao_qunfa_5.70\SkinH_EL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2756

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\taobao_qunfa_5.70\SkinH_EL.dll,#1
2⤵
PID:2800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads