99032750d18472040619864f6ef0ad0dfb3aa1bb42aae6e96863356775931684 | Triage

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 23:37

Sharing

Report Analysis Logs

General

Target

QQJQSF/QQGame.dll
Size

56KB
MD5

19525c2db0c299c8a67ccab7861c8cbc
SHA1

b9d1a8f72d26cfabbdc064f013ec32c79661aed9
SHA256

45894f229c9ec02c76351c6b96a511dec861c1839685aad69c4d3eaf492bd7f8
SHA512

a36db80b970e6a99845ba3a54d310ac281b725064792ae035b194f29b9e8e609262a35e5446f4720d11c1bcecedbdd8a0260d9693ec88e84fe211a755f96e712
SSDEEP

1536:thPn3JpuZB6vL0I8L3V5S38/Hyumtmku4B0PutCVo/tC5:fnDuaT0H3V5fHyrmpU0QA

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2272	2244	rundll32.exe	28
PID 2244 wrote to memory of 2272	2244	rundll32.exe	28
PID 2244 wrote to memory of 2272	2244	rundll32.exe	28
PID 2244 wrote to memory of 2272	2244	rundll32.exe	28
PID 2244 wrote to memory of 2272	2244	rundll32.exe	28
PID 2244 wrote to memory of 2272	2244	rundll32.exe	28
PID 2244 wrote to memory of 2272	2244	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQJQSF\QQGame.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQJQSF\QQGame.dll,#1
  2⤵
  PID:2272

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads