c760e27b4fd16ff8ddb219856ef59e1268681f53de8e266723a1b558c0f1fb8f | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 12:33

Sharing

Report Analysis Logs

General

Target

QQ飞车老鬼辅助 3.6/点此打开辅助！/cfgdll.dll
Size

59KB
MD5

929f56b46242fa68a616374a5403689b
SHA1

45b4ade1f0cc2bf13e74d9801eee5c7abee3c3b2
SHA256

767b2e735693a9455a23b19e7a94643fd6095fa1158cbe22f612d657ebbb670d
SHA512

81c69649efff9d320533bcb3256d42c671877e1d48f9df99134c514aa2d888d11ded13b9d3447949881513e376cf4644b41b997cad2a9ffb51f4f45ca3cdc641
SSDEEP

768:eaEHTGEBv6OuJjxqbhJKOBGxoVlbP2nP8oMRIEw8q:eHHTG7OuJjsKOBlVh+EoMjw8q

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2224	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 2224	2016	rundll32.exe	28
PID 2016 wrote to memory of 2224	2016	rundll32.exe	28
PID 2016 wrote to memory of 2224	2016	rundll32.exe	28
PID 2016 wrote to memory of 2224	2016	rundll32.exe	28
PID 2016 wrote to memory of 2224	2016	rundll32.exe	28
PID 2016 wrote to memory of 2224	2016	rundll32.exe	28
PID 2016 wrote to memory of 2224	2016	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\QQ飞车老鬼辅助 3.6\点此打开辅助！\cfgdll.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\QQ飞车老鬼辅助 3.6\点此打开辅助！\cfgdll.dll",#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads