5586c5e1a139fffc4c11136a6d371a6173f363a46ee9f2b46e8fb9e7df363b74

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 08:10

Target

printerfix/旧文件归档/win32spl.dll
Size

613KB
MD5

829f9e0d63e9a4e8c1a40a821114e189
SHA1

356f13b8db6918d4fbc4c59b50c970d3b175bedc
SHA256

b027966e23657a6007806a69624a211d3e7ae0cbf1a80ce057fd5072aa2bf1a7
SHA512

e40b8b59fa129c455e2530ff15a63127da09adf897b82775badc27036fbfdf36a8c93822b0023f788f8a16ddc3dd983a718c24acda355a51b7162bee01c4cb27
SSDEEP

12288:NcDnAlo784gqSp1k/Lfr8aJ3sWuib49isyUnVhZzj0leLkh1z24pN:NcDnAlo7LRCk/LfjsWuibiisyUnJzj0t

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1380 wrote to memory of 1672	1380	rundll32.exe	rundll32.exe
PID 1380 wrote to memory of 1672	1380	rundll32.exe	rundll32.exe
PID 1380 wrote to memory of 1672	1380	rundll32.exe	rundll32.exe
PID 1380 wrote to memory of 1672	1380	rundll32.exe	rundll32.exe
PID 1380 wrote to memory of 1672	1380	rundll32.exe	rundll32.exe
PID 1380 wrote to memory of 1672	1380	rundll32.exe	rundll32.exe
PID 1380 wrote to memory of 1672	1380	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\printerfix\旧文件归档\win32spl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1380

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\printerfix\旧文件归档\win32spl.dll,#1
2⤵
PID:1672

memory/1672-54-0x0000000000000000-mapping.dmp

Download
memory/1672-55-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download