7882eab29859c18474d3674f7802e17c2c78616f3dc9c5afbba04bd30db1b213 | Triage

Analysis

max time kernel
132s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
04-07-2024 19:03

Sharing

Report Analysis Logs

General

Target

CAD迷你画图/GeoSymLib_Res.dll
Size

24KB
MD5

e9582f5a931ec0d7a4dbfe15abb00830
SHA1

8e4518b52ae313d42556b2eecbbbddc09e7aa4d6
SHA256

56fe676506482caa553d36bd9017646fbd2a001b2ac0dd8657014072cde41383
SHA512

8dc05adafdd849e81e27c52f525062baaf3ecb878fc111855092386a11e98b9f85512011e45bde5f4c4a0ad33bf1d87d142baa33f987a3054434654ddd818a43
SSDEEP

384:iFQQgyOv3PVYJVZXnYPL1phdpt9Sx8JN77hhJD:iFQQpy3dYJXXYphdp3f3hzD

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 5048 wrote to memory of 4248	5048	rundll32.exe	85
PID 5048 wrote to memory of 4248	5048	rundll32.exe	85
PID 5048 wrote to memory of 4248	5048	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CAD迷你画图\GeoSymLib_Res.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CAD迷你画图\GeoSymLib_Res.dll,#1
  2⤵
  PID:4248

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads