1870b01e34e63e03d493053e9dabf6236abbc7db134ceb17dbf70bf014d7d7ea | Triage

Analysis

max time kernel
110s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 16:57

Sharing

Report Analysis Logs

General

Target

lolxc/LOL星辰辅助V9.4【超强脚本+超强躲避】/使用说明/插件注册失败打开.bat
Size

28B
MD5

16610974828b7bbff2b1a28c3cdd0b37
SHA1

8c368cfda55ea7ce1723e7e11d1cf5c9963e1694
SHA256

95283d484cf1d97318cbd6ae8da7f4ed5739012025cd6519e832fe3b50bf6e5e
SHA512

fd8c88650679f4263fbcddbfd793c22d4aac89e5caf4e03c29773dd1b0b6df27238d5cc74cdccb3a62c9bb986608cf23afe94a4bcfd341d044788d33b9923cd8

Score

1^/10

Malware Config

Signatures

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2332	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2332	1976	cmd.exe	30
PID 1976 wrote to memory of 2332	1976	cmd.exe	30
PID 1976 wrote to memory of 2332	1976	cmd.exe	30
PID 1976 wrote to memory of 2332	1976	cmd.exe	30
PID 1976 wrote to memory of 2332	1976	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\lolxc\LOL星辰辅助V9.4【超强脚本+超强躲避】\使用说明\插件注册失败打开.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\system32\regsvr32.exe
  regsvr32 "C:\windows\XC.dll"
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2332-0-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download