d52138cdf8524c5fcaef9770eaf300b4e820e8d002869789bd056b16afbc9da9 | Triage

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 01:33

Sharing

Report Analysis Logs

General

Target

乐刷助手(淘宝小号管理，拍单助手) 2.1.9/BmpOperate.dll
Size

100KB
MD5

935460394f18a04cd02331690f74096a
SHA1

396a75517c6ec2543a021156f3c1f7a7e69f49c4
SHA256

848c1b8a90596c2afd47127c41bf8d6a7b7fb95ba668ad514affe66b632a8586
SHA512

4378ead4a4244ef2d531865135d4af02f4747038ea451d1798ecb453b81887e89c0ed695421f52f69d7226794a2f21f223769bd838fb1f9a0c111b2e055a6ed7
SSDEEP

1536:iqZ1aL0w0h4FLGtGAYdITCP941lcloKKEyU:iYl1YEyloKKEy

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 2076	2940	rundll32.exe	28
PID 2940 wrote to memory of 2076	2940	rundll32.exe	28
PID 2940 wrote to memory of 2076	2940	rundll32.exe	28
PID 2940 wrote to memory of 2076	2940	rundll32.exe	28
PID 2940 wrote to memory of 2076	2940	rundll32.exe	28
PID 2940 wrote to memory of 2076	2940	rundll32.exe	28
PID 2940 wrote to memory of 2076	2940	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\乐刷助手(淘宝小号管理，拍单助手) 2.1.9\BmpOperate.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\乐刷助手(淘宝小号管理，拍单助手) 2.1.9\BmpOperate.dll",#1
  2⤵
  PID:2076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads