7882eab29859c18474d3674f7802e17c2c78616f3dc9c5afbba04bd30db1b213 | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 19:03

Sharing

Report Analysis Logs

General

Target

CAD迷你画图/libcurl.dll
Size

271KB
MD5

ffa35d67d3bedc686d9dafda2f470f0e
SHA1

2bafc7e20a75a7f905154de486baeb61730832ce
SHA256

614f75e15cb3103c105988c4b4bfe7b0b7b8594e08c91a66359b8b732b6a3ac2
SHA512

5f2269325e2046eb3ce20b16d28046d27718aa1f93fe86ea57f290b5be6f67f34d53f735199a01d2c97c64bdb05b14cafe7163b35bfe4c84f803c69dbfa505a2
SSDEEP

6144:OowDwI8+DMP4ZpATqRQEWBH3VOCBW71edpK5GF3:O/y+u9qgNksc1K3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 1668 wrote to memory of 2228	1668	rundll32.exe	28
PID 1668 wrote to memory of 2228	1668	rundll32.exe	28
PID 1668 wrote to memory of 2228	1668	rundll32.exe	28
PID 1668 wrote to memory of 2228	1668	rundll32.exe	28
PID 1668 wrote to memory of 2228	1668	rundll32.exe	28
PID 1668 wrote to memory of 2228	1668	rundll32.exe	28
PID 1668 wrote to memory of 2228	1668	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CAD迷你画图\libcurl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CAD迷你画图\libcurl.dll,#1
  2⤵
  PID:2228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads