905e7a135834baf2f139e57b3ba4e59892684221d3132ff6463ad1902a0b11cd | Triage

Analysis

max time kernel
140s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 16:48

Sharing

Report Analysis Logs

General

Target

QQ自动加群王V3.3 2014_破解版/edroptarget.dll
Size

156KB
MD5

97f7c4fbfba371da85daa16d2b6361e4
SHA1

38ed0559ad650bcd6829b1a727ff952e9c7ac0d2
SHA256

6dc5166cea229e69f66fcb5241c7a47515db4db0e4fff79b9b3ccb528e27e378
SHA512

5576d028dd0d0fde98d7406e5c9ada9df493d81747937842b504a783259dbd11a68317dbe9da219d79fdf0d1eb375210c39ce191a75526cceb95d3bbf5e2e410
SSDEEP

3072:RP2pXJ7gQo4/YeC8bGfnG1jklrTGWmGdxDoWkVesmn:RP2H1iWSuovzdUesm

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 3564	2136	rundll32.exe	90
PID 2136 wrote to memory of 3564	2136	rundll32.exe	90
PID 2136 wrote to memory of 3564	2136	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\QQ自动加群王V3.3 2014_破解版\edroptarget.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\QQ自动加群王V3.3 2014_破解版\edroptarget.dll",#1
  2⤵
  PID:3564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3980,i,13281073920029625837,8253721632651544158,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
1⤵
PID:4040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3564-0-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download