ef5815e74b2100278cef38352b713ee969595996ae1c816a421d4ec16ae70585 | Triage

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 12:36

Sharing

Report Analysis Logs

General

Target

Xy.QQ极速申请器V4.0【春节联欢版】/MSINET.dll
Size

113KB
MD5

40d81470a19269d88bf44e766be7f84a
SHA1

4030e8e94297bc0aa5139fe241e8cf8f8142d8d4
SHA256

dd1215f01b484e7842763302d42749d516963d9ac74e2fe8825a5eaba34f6229
SHA512

e4a39613cc32885b67f6219281fbf99f50018b5fd2886b5389cfa04dc9dc4ebfc46fca2b9e89586116094fa3a7600c20b2ca0fa3535dd2615739621856506864
SSDEEP

3072:ef5gDRNZfPxXEe3RCzT9/L1BJSS2QHvK2:eBgL3x3RCzTBP

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 3448	2832	regsvr32.exe	84
PID 2832 wrote to memory of 3448	2832	regsvr32.exe	84
PID 2832 wrote to memory of 3448	2832	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Xy.QQ极速申请器V4.0【春节联欢版】\MSINET.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Xy.QQ极速申请器V4.0【春节联欢版】\MSINET.dll
  2⤵
  PID:3448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads