efedcc937d815ab3d2630eb3ba48d6611eaf280314017cd07433b012aefa8108 | Triage

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 18:47

Sharing

Report Analysis Logs

General

Target

gen_yqllyrics.dll
Size

52KB
MD5

f811ae048d4c047327ed7e595910436a
SHA1

64ca166e6c5f004811aaf1f7947cbc98eb237e1f
SHA256

5d4e90ebdf0c5bc432752d0472950da456a32f097a029b42258a2687d67f9cad
SHA512

46dc4b8faee0466c5f28359aee1665d0a76e9bda6bf2365b3100a2d89855b07f88f3014950a0f33a3e895e75a6a344991e6e969e9349105f1af181954f340f6c
SSDEEP

768:3jzanFsHu9d+PN/qgR6UA8Omzaa9JZtltVtKYUqw9:3j6FLaz287zamztKYUqw

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2360	1684	rundll32.exe	30
PID 1684 wrote to memory of 2360	1684	rundll32.exe	30
PID 1684 wrote to memory of 2360	1684	rundll32.exe	30
PID 1684 wrote to memory of 2360	1684	rundll32.exe	30
PID 1684 wrote to memory of 2360	1684	rundll32.exe	30
PID 1684 wrote to memory of 2360	1684	rundll32.exe	30
PID 1684 wrote to memory of 2360	1684	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gen_yqllyrics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\gen_yqllyrics.dll,#1
  2⤵
  PID:2360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads