e95b5f032ed246f3f9c0bc27017e46940056f5c5fa3dbb7b2f6e0c965e69a4f2 | Triage

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 16:27

Sharing

Report Analysis Logs

General

Target

gen_yqllyrics.dll
Size

52KB
MD5

f811ae048d4c047327ed7e595910436a
SHA1

64ca166e6c5f004811aaf1f7947cbc98eb237e1f
SHA256

5d4e90ebdf0c5bc432752d0472950da456a32f097a029b42258a2687d67f9cad
SHA512

46dc4b8faee0466c5f28359aee1665d0a76e9bda6bf2365b3100a2d89855b07f88f3014950a0f33a3e895e75a6a344991e6e969e9349105f1af181954f340f6c
SSDEEP

768:3jzanFsHu9d+PN/qgR6UA8Omzaa9JZtltVtKYUqw9:3j6FLaz287zamztKYUqw

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 2188	1584	rundll32.exe	28
PID 1584 wrote to memory of 2188	1584	rundll32.exe	28
PID 1584 wrote to memory of 2188	1584	rundll32.exe	28
PID 1584 wrote to memory of 2188	1584	rundll32.exe	28
PID 1584 wrote to memory of 2188	1584	rundll32.exe	28
PID 1584 wrote to memory of 2188	1584	rundll32.exe	28
PID 1584 wrote to memory of 2188	1584	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gen_yqllyrics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\gen_yqllyrics.dll,#1
  2⤵
  PID:2188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads