21422f8dffcd0e9191c7af77b416622382e4fd9a1fc38b96ab3e11494e8d9ceb | Triage

Analysis

max time kernel
62s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 09:04

Sharing

Report Analysis Logs

General

Target

易语言邮箱客户端/pop3.dll
Size

164KB
MD5

68a3720cb4bb5d079b90867177a7bbf3
SHA1

75f5b5de69757293dae3eff7c5561938f7c1dc4d
SHA256

ffb23a6c07ee55e2801761faaa6160c1529ad3d17797a9e1e549c3a493e53fc3
SHA512

d1cdad2b7ad241ff5df7298baa854f13d71d1e5a1c61998905228636ce4f11d792ce429b39337c7f70385c6f3995c68f2fce4ace1ce80d551f1ae29d61028a5c
SSDEEP

3072:/ipEtFbthgqh3hN/UtuYWctn99gh0Y8qOF8mvdo7U:/ipwb/gqh3hdUtGct92h0YGSU

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4912 wrote to memory of 412	4912	rundll32.exe	rundll32.exe
PID 4912 wrote to memory of 412	4912	rundll32.exe	rundll32.exe
PID 4912 wrote to memory of 412	4912	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\易语言邮箱客户端\pop3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4912

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\易语言邮箱客户端\pop3.dll,#1
2⤵
PID:412

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...