49c6d44dbb82d1f3760736f2eac2c10fad305d1518492a3f2837526f0c1a17b4 | Triage

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 22:19

Sharing

Report Analysis Logs

General

Target

软件印章大师8.0 破解版/Comlfyfun.dll
Size

602KB
MD5

dde8945c0ab96e587014cff5b8ff3087
SHA1

c6c6d571e596bdc1845b1980b12b5fde9191f9f9
SHA256

8da01bc548592c79452e5da5c4137ce0eaa3a6c2d95531df91c84e59e4231fe1
SHA512

d0ec6b442e0317fdba066367883d69c932ba5a61108cd258d2d89a9baec0255210e4972e902e45b7c03ffd00f13b49958144ef2edd4ab7e8e57cdef752fd92eb
SSDEEP

12288:T/w0gn64RrnLRODmEO67uRQOiAJ0rB2MUIi5IpJLRnSjn:8X64htOyEZ+9itbC5IDLRnwn

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 1928	2728	rundll32.exe	28
PID 2728 wrote to memory of 1928	2728	rundll32.exe	28
PID 2728 wrote to memory of 1928	2728	rundll32.exe	28
PID 2728 wrote to memory of 1928	2728	rundll32.exe	28
PID 2728 wrote to memory of 1928	2728	rundll32.exe	28
PID 2728 wrote to memory of 1928	2728	rundll32.exe	28
PID 2728 wrote to memory of 1928	2728	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\软件印章大师8.0 破解版\Comlfyfun.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\软件印章大师8.0 破解版\Comlfyfun.dll",#1
  2⤵
  PID:1928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1928-0-0x00000000007A0000-0x000000000083C000-memory.dmp

Filesize
624KB

Download