a13fad0d43b3db3b1f78118c3591a42cca0ed4373414ed82f2351719b2901b92 | Triage

Analysis

max time kernel
133s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 06:00

Sharing

Report Analysis Logs

General

Target

Triworks/乐音 3.0 (Demo)/ltimg11n.dll
Size

124KB
MD5

5286c0282140edf9df55a843237fa568
SHA1

657be7db3058ee5e2bb72dc22bd6dc0dc326edc9
SHA256

af2fc4b3dfb153a2101c136aab8b955bfb81b6c10bfcda378196c49aaf46a9e0
SHA512

6da0f3dbbaab3c65b8d652e4c766d5cade0e1ff4bb1ba878b7046c72481a07a4a5aea7cedfee1492a35edf6dd4fdc003cf02b90f11f57eb176abad3c1e3be53a
SSDEEP

3072:i1XrFCdwWkAKIsqlF7Lj1Q8RBhAjyf/Pd2XRGkggAL:E7FWwWtKkQUBKuXvI

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3240 wrote to memory of 624	3240	rundll32.exe	rundll32.exe
PID 3240 wrote to memory of 624	3240	rundll32.exe	rundll32.exe
PID 3240 wrote to memory of 624	3240	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Triworks\乐音 3.0 (Demo)\ltimg11n.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Triworks\乐音 3.0 (Demo)\ltimg11n.dll",#1
  2⤵
  PID:624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/624-0-0x0000000002D50000-0x0000000002D91000-memory.dmp

Filesize
260KB

Download