d52138cdf8524c5fcaef9770eaf300b4e820e8d002869789bd056b16afbc9da9 | Triage

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 01:33

Sharing

Report Analysis Logs

General

Target

乐刷助手(淘宝小号管理，拍单助手) 2.1.9/const.dll
Size

952KB
MD5

1718e9013e5d5a4d0e6b4890be957e37
SHA1

d3684d849d96e4b1712206f07d737a1cee94716b
SHA256

6d00e79b70e57209ae623f59480e3255d87a60858da87dcc751cd3018796f759
SHA512

6b1b2a538346bc73c30f24eb06ad217b1bbb80e880551e6107e7a0e286321e32823e3a4b6c12d1a8e34b416324247fbb5f93b54fb4f838f13f3174072e636e71
SSDEEP

12288:Cqh/i7xvXMrYsah466BEqAoketLGQQA51ictk4m:CqVCsaJOAiGQr1ica4m

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 2196	1632	rundll32.exe	28
PID 1632 wrote to memory of 2196	1632	rundll32.exe	28
PID 1632 wrote to memory of 2196	1632	rundll32.exe	28
PID 1632 wrote to memory of 2196	1632	rundll32.exe	28
PID 1632 wrote to memory of 2196	1632	rundll32.exe	28
PID 1632 wrote to memory of 2196	1632	rundll32.exe	28
PID 1632 wrote to memory of 2196	1632	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\乐刷助手(淘宝小号管理，拍单助手) 2.1.9\const.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\乐刷助手(淘宝小号管理，拍单助手) 2.1.9\const.dll",#1
  2⤵
  PID:2196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads