6734e708c6beaf74eeca069129144d5fe7aec8b9a3ac3154a1e5df6647782f9b

Analysis

max time kernel
131s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2022, 04:33

Target

CADe_SIMUdqfz电路图仿真软件/CADe_SIMUdqfz/MFC42D.dll
Size

363KB
MD5

59c86163380f19a105d5aacfc4271d3e
SHA1

5648be24e833c94c9fcde56d6dd6de41d509858a
SHA256

2ad8a8bfef59c00b224ccad342803ad61ea9f1c7ccd600d4fa8ca5f77e44e360
SHA512

5c7b693634be22cc5f793bb2daeb80436168c41efdf6060eccdd985a93222364f0f44b1e979adc4a11361785f6453e8d8766e941b10129887b82f0ab4068dfe2
SSDEEP

6144:gOuz3Yu36kel0KaX4T1l7GAj6MH88z7uwljaUlCTks2fBk22sty49cD6QV9d:mz3z3nxKaXgsu6srB1t8D6K9d

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 4928	4384	rundll32.exe	82
PID 4384 wrote to memory of 4928	4384	rundll32.exe	82
PID 4384 wrote to memory of 4928	4384	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CADe_SIMUdqfz电路图仿真软件\CADe_SIMUdqfz\MFC42D.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CADe_SIMUdqfz电路图仿真软件\CADe_SIMUdqfz\MFC42D.dll,#1
  2⤵
  PID:4928

memory/4928-133-0x000000005F400000-0x000000005F4E8000-memory.dmp

Filesize
928KB

Download
memory/4928-134-0x0000000010200000-0x0000000010263000-memory.dmp

Filesize
396KB

Download