Analysis
- max time kernel
149s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 04:37
Behavioral task
behavioral1
Sample
Dungeons存档修改器.exe
Resource
win10v2004-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Dungeons存档修改器.exe
Resource
win11ltsc2024-20260911-en
2 signatures
150 seconds
General
- Target Dungeons存档修改器.exe
- Size 12.0MB
- Sample261002-e82jmsvz8r
- SHA256 d044f3e128970a0fd1fa5ffc60cdea343cae404890890d72711fdac74630097c
- MD5 797011f76e35d1f8ce96ea80f44ed229
- SHA1 7919fbe8b6ee19223d7fbebf60d84819a8338b4f
- SHA512 09081960217e15c2a98101f3f308ab8fdfb277aae7e107e3ca57ab36903c89748f40ca9b42a39ebc742a05259505e93e7e3fe198383fa8260862f755f80cb675
- SSDEEP 196608:/+IWJRXEpXnH2ph1iutoxSiLCw10+u41ZPcUQ+jlJg4MtAy9bW6q7htyUvonYpP+:2IWrXEAphVta510MjRnpASjyUvUYD
- TLSH T1E5C63318F75050FBF8F7803D89929C42A7E2B6161BA692DB26B005663F772F05E3CB54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 12 IoCs
pid Process 5448 Dungeons存档修改器.exe 5448 Dungeons存档修改器.exe 5448 Dungeons存档修改器.exe 5448 Dungeons存档修改器.exe 5448 Dungeons存档修改器.exe 5448 Dungeons存档修改器.exe 5448 Dungeons存档修改器.exe 5448 Dungeons存档修改器.exe 5448 Dungeons存档修改器.exe 5448 Dungeons存档修改器.exe 5448 Dungeons存档修改器.exe 5448 Dungeons存档修改器.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4196 wrote to memory of 5448 4196 Dungeons存档修改器.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\Dungeons存档修改器.exe"C:\Users\Admin\AppData\Local\Temp\Dungeons存档修改器.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\Dungeons存档修改器.exe"C:\Users\Admin\AppData\Local\Temp\Dungeons存档修改器.exe"2⤵
- Loads dropped DLL
PID:5448
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000010642\VCRUNTIME140.dll
- Size 174KB
- SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
- MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
- SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
- SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
- SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
- TLSH T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000010642\_bz2.pyd
- Size 86KB
- SHA256 b938073c85cf6b9fe80556d7899ed1901e5e60b7adea2832442376239fb36b36
- MD5 4cc74cced07914bd71dc9c4d2a3f127a
- SHA1 77bda774eff7c8afc94892d2d5d63dd3c80f9ea4
- SHA512 8f81a5287bc5f59eeb6bb6703c00495cf761816e6eb20b6cb401af20040464fffc5b5e95d21b49d6260debb9cfac4031cf87b5248c0077fa8edd0d390cc1910b
- SSDEEP 1536:+/BvOKz7hvAKyRXzgwnZpfzyONpGX/4TjW8hSlUbrjvUIp3VJyPs5i9EfIY+8i:YBvLztGRXHyONpE/ajhwYXUIp3VGV
- TLSH T185838E87E3A463F6F6AB81B4D6810753E730BB460750A3AFB24482853F23F91AE59355
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000010642\_ctypes.pyd
- Size 139KB
- SHA256 408cc4e7a22ffa418ca52f5e13fe9268a3c50a2bc9de02b0530b555ef591bc5a
- MD5 659510afbc97992af071a0e2a75545ef
- SHA1 ec7dba6821ccc0e6b9f851d39812e0de3627130b
- SHA512 76a243fb96129041bccf92c2e231efdb53aba519bb26d919dc8b213e949fc0534448bf75400702c03850abb7cd24b1cbd37e0d0c76615a34248615aa44cde4d1
- SSDEEP 3072:e/n1qQ8rqSN56EBZSQ4ED1O/IxswJQW2DfrFAIpGPMS:on1Jb86JE0/IxfSvF6
- TLSH T149D38F4B736840E6DA678138C6739E47EBB1F4511A1087CF02A4C99B1F637A2AE3F715
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000010642\_lzma.pyd
- Size 157KB
- SHA256 d2abf8db7fb0cf6285663b177991691a41b37e215c3d71fd087a98d8ec1bee63
- MD5 e882005d06af06ef17b2338342b3f41e
- SHA1 96dfac53ce267a9dd4d094bf5c5a665bc1cedfe9
- SHA512 1e53c3501796da814f75ba8fc683720e968c5944fbeb2b9836c48a6656df0da120c075bc6c17ea788efa14be11f29172e80c64febe72e43502a02f707a5928dd
- SSDEEP 3072:NJ66g4T5QW7JfyjEqkSkA51b4rznfJ9mNoVUIsbUIpI1yUx1:NUR4Tp4QPZ8N4nxYOIbHy
- TLSH T1FDF34C86B794F0E6F7328C78D2614F57E6F5781A0320929A01CC976D2B1FB759A2E313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000010642\_tkinter.pyd
- Size 69KB
- SHA256 ee3eb2cdac591821cf71cda8035a6bc9b148d92996dd45b24e3ae3715613315d
- MD5 3fa21737ba104b04ad3cc69d96885d47
- SHA1 06eb875339b8f1bb6f1d1fa429d4374ed1a5d210
- SHA512 b7a30ed377247ac32c84253b2f46052c0177e5d5e7c9156a5c89d8ebd02a6e1967bb3b73a76dfe44e7ebe7c307eedbc64cd108f6875fc552f575b7adeb2a6f83
- SSDEEP 1536:a3rQ5jzPC333f/x6pY33mZgZ0+jcIpDSJyPs5i9ENfIbHfnUn:a3sJD233syGZgLcIpDSNOTw
- TLSH T120636D9B6764008AFDA3D139C6729F53E5B5F9521A20824F40A4C39A0F373F3A7BA751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000010642\_zstd.pyd
- Size 491KB
- SHA256 33c6eca99470c3eb9d776b617c550ad41b002a668336f062a9ab7be677a7409a
- MD5 fee9e34fa16e0ff378c281202a78d003
- SHA1 d8681b1ecf3776d1f095ecb738210423bcfec287
- SHA512 766fa08c57cb9e000237a5690e6bae8fbe2d2fb79fdf39f1a2f07ec668ee225df9675c9041d4b26410cbb4fb341693454dbcad722bcff3e78321412e0bfcf4ae
- SSDEEP 6144:HoRvcMPHwrJqB2l1eUVcXmgqCBdBwzKhThruVxzeeVUL2LzMYZpzBYQFE95+SClu:IRFcemgqKP2eeVC2Lz9kQe95BCl9Vmxp
- TLSH T1C2B48D43F29943EDE53BC4B8CF465A13FBB1780B1214965B97A5CB993F07B309A69308
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000010642\base_library.zip
- Size 1.3MB
- SHA256 53bd729d0b4a56cfcd21ed5e696f13754074e597993f4e380149269866b14d0a
- MD5 a0291b24eeff9738424bda2797f927ad
- SHA1 4d0396c5053ea9ea6625653a0dd385aa064fc17a
- SHA512 b4c094283a90df3b1d5bcce13a0f043d527996f8fd7c5dcc1615ef6d570e27d4e498d257fc827a9cc452a123a888fe0d683ea3b7cdc372913d54ea646b1bdbd8
- SSDEEP 24576:6xLuY09uUFIQeOdP2m2dfUd+TlbODZYRZRFS:7YAuUFI/sdZ2RM
- TLSH T100552B91B9917967FEC9F37A35B75A0CA715C0109B20D303B4A88DAC6FDF260AE558CC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000010642\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000010642\libtommath.dll
- Size 93KB
- SHA256 bf18448a56de62e56adb5a50040c08648f0bcf556217de90eca283490ee8c0c3
- MD5 8fba15875ec56759f9300af889066f76
- SHA1 efd8808926ab7418cffd5580b08c6fa24c83bf1a
- SHA512 4e3421805be032eec1bb607470575270eb7aecfd0e65cf44943f61fd2d35178b8deaea3d0c7e4093736f4a4a02c63014dea74f263e8a3d4571b0d996a436bdcf
- SSDEEP 1536:p3RaimSoWEBrh2as3iwaOasKuWoSvMD9NNKyPs5i9XfIY0T:1qWEBkL3iwvrD9NNUV
- TLSH T178936B4BF6CA10FFC05AD5B1C3069313A6B2B9539B266AEF23016E251D16BD06F3F254
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000010642\python314.DLL
- Size 6.5MB
- SHA256 0f9857ffdfe010fe6b99328d58c2e3c7472ce75f336bf9c2ad9bd5bca3bce700
- MD5 689a9724a63fb3b4f209c771c31d8a05
- SHA1 2f88e8e16a9086e7974da71914fe4e89cd2eff9a
- SHA512 0c96ec1b9ef6e56f29202681272c1062ea49867757c966ebdd050c513d4988cfab7cd6c31e1d94f438c1412b38f7b446af1629b2776c41d712051ab70054ac9f
- SSDEEP 98304:xEQucV/qdDSSmJBA3ICXmRaJtv3vyHDMiE4rofB:xEQucVygSmJBA3InSiFG
- TLSH T19F668D26737515A4D8BB8035C9034647DBB1BC00AB30D34B49A4B6DA3F733635BAEB99
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000010642\tcl90.dll
- Size 3.2MB
- SHA256 ecf6c76a725d082a0f00c5940d39a5a71087d0e9d166eaa07d1d6b122a195020
- MD5 4484a3384db1ccace8d1d8c1ebf115d6
- SHA1 4dfcda3c1d67a681617ab052cd0458bfb660fd1b
- SHA512 affd19a64a97c59d1d5e896f9b5e11c7012225efdd2ba897d6dda11677bfce8f978fe09cdb8d834da901219f2f12993a1e6781931ccf5ed21eedcba00ad0bfa4
- SSDEEP 49152:mLtprceZwI8raQOc9GEVDUCjTCFva4v5XjqAoFRqux9umJSw+wnxq3BfXAqUcugN:0WrPOVNFFvsJnNKfXAqRGYYQ
- TLSH T1CDF5AE46EBA40068D5B7C27CC61ADD4BDFB274581364AADB14E05B612F73FD2237A322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000010642\tcl9tk90.dll
- Size 2.1MB
- SHA256 6e81d58860701540042b8168af929c54437b3f4143bf1b8f6114e56c3b9a8df0
- MD5 21f89d187a756935d97d972d80ae5b10
- SHA1 4e95ac93af3f81fda09249181325156b89819bdc
- SHA512 767cbe673c5f323c2711eb42471791ceb1c98c0e1c0061a570a436a773db811318dd93a3faf004b4d61b7f8ccb47aee05c5df7c3c28348e5bd71937bf0ea3560
- SSDEEP 49152:w/DN5QCQ7T3hJ00UYaut3HZbJTzdMltYxGaN+VH/GMU6T:Gs7+8JToVH+M1
- TLSH T12BA55B06E2A88098C067967CCE2761AFEBF13C04975956DF6191BE9D7F73BE1073A210
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000010642\zlib1.dll
- Size 114KB
- SHA256 6bc87ac126b343f794ff14254d2cb6fbfbeef5476c0272e7297c5b4e8acfc353
- MD5 ada9df12e27f3e0fc5cd668cf87d7e4c
- SHA1 34ac2e25f6390c4b81ee65c022a0cf7de4a6f4f5
- SHA512 b27a42a68b4babd9049ce438d484fbc2770ccd5e8ee26faf3b7757a3cb3d8dc877a48d944d21b9f625e50f5602085cce28b1027c88aa40647d5905a02a7c04d7
- SSDEEP 1536:9eKwGDT0PvmR462JPHiW3beTnaYMSy6W2geD2onVs4iC+5VVRn6dhjIOXws+fBLt:ENGH+X34najvon8PVh2FXws+Zy5LW
- TLSH T14AB39E87799620AED5B7C230D6E65B22F67538810B1C1BF70285E3642F02BD06F797E9
- MD5 SHA1 SHA512 SSDEEP TLSH