d2af3d04ed53b300b6208c6b6075d70be7f698541c95610e6ddb1bcb03926e17

Analysis

max time kernel
91s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05/11/2022, 15:56

Target

HDD Regenerator 2011 Portable(硬碟修復壞軌程式)正體中文可攜版/CWindowssystem32/cc32100mt.dll
Size

1.1MB
MD5

1ec6fe4798163c9eab3bc7835fbf4f47
SHA1

98a866e8cd1668032709315998db64fae20b6690
SHA256

d221da673572c2d0c8edc23de7dfeea3e6cd6e994427ae48565a16751a3871bc
SHA512

5afa699507a790d757d05b251126d2dbf83db7808242586dbfe5d4dabe4b6506f266622f9c36490dcf29d89d78e0b97c2d4b960017255608a2f86e98759a1a43
SSDEEP

24576:476TpkGU8Y5weSSoaX4ripuXQ9hlbyRTzhRaWnEZN1e6HfSDu/hwY:Eejxn6N1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 1400	2288	rundll32.exe	82
PID 2288 wrote to memory of 1400	2288	rundll32.exe	82
PID 2288 wrote to memory of 1400	2288	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\HDD Regenerator 2011 Portable(硬碟修復壞軌程式)正體中文可攜版\CWindowssystem32\cc32100mt.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\HDD Regenerator 2011 Portable(硬碟修復壞軌程式)正體中文可攜版\CWindowssystem32\cc32100mt.dll",#1
  2⤵
  PID:1400