905e7a135834baf2f139e57b3ba4e59892684221d3132ff6463ad1902a0b11cd | Triage

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02-06-2024 16:48

Sharing

Report Analysis Logs

General

Target

QQ自动加群王V3.3 2014_破解版/edroptarget.dll
Size

156KB
MD5

97f7c4fbfba371da85daa16d2b6361e4
SHA1

38ed0559ad650bcd6829b1a727ff952e9c7ac0d2
SHA256

6dc5166cea229e69f66fcb5241c7a47515db4db0e4fff79b9b3ccb528e27e378
SHA512

5576d028dd0d0fde98d7406e5c9ada9df493d81747937842b504a783259dbd11a68317dbe9da219d79fdf0d1eb375210c39ce191a75526cceb95d3bbf5e2e410
SSDEEP

3072:RP2pXJ7gQo4/YeC8bGfnG1jklrTGWmGdxDoWkVesmn:RP2H1iWSuovzdUesm

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2580 wrote to memory of 1512	2580	rundll32.exe	28
PID 2580 wrote to memory of 1512	2580	rundll32.exe	28
PID 2580 wrote to memory of 1512	2580	rundll32.exe	28
PID 2580 wrote to memory of 1512	2580	rundll32.exe	28
PID 2580 wrote to memory of 1512	2580	rundll32.exe	28
PID 2580 wrote to memory of 1512	2580	rundll32.exe	28
PID 2580 wrote to memory of 1512	2580	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\QQ自动加群王V3.3 2014_破解版\edroptarget.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\QQ自动加群王V3.3 2014_破解版\edroptarget.dll",#1
  2⤵
  PID:1512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads