243f3743b7c0353104dffd185aa6d754407e7b31c3840e30fdc5ec66d7f1c11b | Triage

Analysis

max time kernel
121s
max time network
147s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 05:35

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/WeChatInstallDll.dll
Size

3.6MB
MD5

334057ab4993b56c8c663b0224b94567
SHA1

09a428a52707171f425d9047e1b89bde1d5966dd
SHA256

3f829f072de5cc33b160f15f62558c86f75f7f96a2673234c9a48c3164f067d1
SHA512

3b40102c35a946a2ac804b680c61cabe0782b1d334d98d2f7aec5bf3946c2ab80098b0399eb69a1d7aca37073e11dacb6876c977415082fea480d9e4f5762d03
SSDEEP

98304:HDEkRLBPfvgP9bjyYfg+nT8/6F7x85V+dL:HDTLpgjhoCF7xkV+5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2896	2876	rundll32.exe	30
PID 2876 wrote to memory of 2896	2876	rundll32.exe	30
PID 2876 wrote to memory of 2896	2876	rundll32.exe	30
PID 2876 wrote to memory of 2896	2876	rundll32.exe	30
PID 2876 wrote to memory of 2896	2876	rundll32.exe	30
PID 2876 wrote to memory of 2896	2876	rundll32.exe	30
PID 2876 wrote to memory of 2896	2876	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WeChatInstallDll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WeChatInstallDll.dll,#1
  2⤵
  PID:2896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads