e95b5f032ed246f3f9c0bc27017e46940056f5c5fa3dbb7b2f6e0c965e69a4f2 | Triage

Analysis

max time kernel
93s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 16:27

Sharing

Report Analysis Logs

General

Target

vis_yqllyrics.dll
Size

70KB
MD5

20ada9591c78ef169ea83cb14093f7dd
SHA1

a1910f5b4b18c6156cfaf9b6a31106831c64b268
SHA256

3f6ad5027a9af95d042f3e6c3c370c5b806594f88098dc3d16f38d6d8af49e96
SHA512

08893ecf8bef19b00b44c493bd8a3f61b29094c07dbfeef6d33706a26b17adc3e2c9ee8ee1856588782b7918fb90f8f81825ca6e67277635b278491a7e343f44
SSDEEP

1536:8cpTdga0ik0jKJMK5IX6IEAdBGQhw78N:rpRg/mExAdBGYNN

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 3084	4532	rundll32.exe	80
PID 4532 wrote to memory of 3084	4532	rundll32.exe	80
PID 4532 wrote to memory of 3084	4532	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vis_yqllyrics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\vis_yqllyrics.dll,#1
  2⤵
  PID:3084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3084-1-0x0000000002B70000-0x0000000002BF3000-memory.dmp

Filesize
524KB

Download