b3af1c9a03ce61ee1eb4e56f99fb6ced16d4825cf9bd0ec379ea0d878f2a21d2 | Triage

Analysis

max time kernel
93s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 20:09

Sharing

Report Analysis Logs

General

Target

网店卖家发货助手/ExtMenu.dll
Size

212KB
MD5

26f03ea4d3ef78a1c8635ad0b06b7cd8
SHA1

33710aa86158f7c859b4ca18672dbca57425d200
SHA256

128495e4406a195720306629127c681ecf21526824964dee4d45b4c53e04a1c5
SHA512

569e260d0af132dbc1571c5818357ae5656b3d54918522279db523baa829e72221cd76f50500378019b0bf1055b42ba59db8217e3453552667566b578535cb73
SSDEEP

3072:Fc9E/ygOeMQGKqnLPBaLbazta3nzfarixalgoLsUuMeehrTWLaM:O9KMLp6bqinzODhFrhrTWb

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 4500	4244	rundll32.exe	84
PID 4244 wrote to memory of 4500	4244	rundll32.exe	84
PID 4244 wrote to memory of 4500	4244	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\网店卖家发货助手\ExtMenu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\网店卖家发货助手\ExtMenu.dll,#1
  2⤵
  PID:4500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4500-0-0x0000000010000000-0x0000000010044000-memory.dmp

Filesize
272KB

Download