d52138cdf8524c5fcaef9770eaf300b4e820e8d002869789bd056b16afbc9da9 | Triage

Analysis

max time kernel
132s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 01:33

Sharing

Report Analysis Logs

General

Target

乐刷助手(淘宝小号管理，拍单助手) 2.1.9/WebBrowser2.dll
Size

256KB
MD5

3a3d1dceb97ed5d5910bafa045792079
SHA1

e165fe1cad177b536899926bb4d7a87b9ad8e750
SHA256

10d234ec2a647149e418af38ab0ddc93f263847400b3cb8ebd54417cf75850e4
SHA512

ef49cbe023b298f1e0bfc1e79f64b53d121b5a546a892f5b04550550890d045ecc29d34461ca1e222707c0428714e48a7b4459a38c066478be3dc64b72190776
SSDEEP

6144:V7lMy5L4J0ULD3FdzERNMk9OfLhq6V0K2:V5My5L4J3XfzEQXfLhq6u

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 1028	4884	rundll32.exe	84
PID 4884 wrote to memory of 1028	4884	rundll32.exe	84
PID 4884 wrote to memory of 1028	4884	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\乐刷助手(淘宝小号管理，拍单助手) 2.1.9\WebBrowser2.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\乐刷助手(淘宝小号管理，拍单助手) 2.1.9\WebBrowser2.dll",#1
  2⤵
  PID:1028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads