16e82bd509cf326cc7b3239459f80196bdde1fb15cad21e03e48189e4e73f857 | Triage

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21-04-2024 16:08

Sharing

Report Analysis Logs

General

Target

taobao_qunfa_5.70/SkinH_EL.dll
Size

688KB
MD5

bd42ef63fc0f79fdaaeca95d62a96bbb
SHA1

97ca8ccb0e6f7ffeb05dc441b2427feb0b634033
SHA256

573cf4e4dfa8fe51fc8b80b79cd626cb861260d26b6e4f627841e11b4dce2f48
SHA512

431b5487003add16865538de428bf518046ee97ab6423d88f92cda4ff263f971c0cf3827049465b9288a219cc32698fd687939c7c648870dd7d8d6776735c93c
SSDEEP

12288:AuOtG9rMIfLpoTp2/WFH8bW7INLtK4dRjKCHd:9z9OIu4d1KCHd

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4412 wrote to memory of 4992	4412	rundll32.exe	rundll32.exe
PID 4412 wrote to memory of 4992	4412	rundll32.exe	rundll32.exe
PID 4412 wrote to memory of 4992	4412	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\taobao_qunfa_5.70\SkinH_EL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4412

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\taobao_qunfa_5.70\SkinH_EL.dll,#1
2⤵
PID:4992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads