d9718394c6c28e85ea09bc6a328dd7b1d9a9171072ae9ac059e519d71e1d4492

Analysis

max time kernel
37s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 15:46

Target

DNF绝情阁模型工具/gj/exrpg.com/Bin32/ExtUtility.dll
Size

592KB
MD5

3841d73f55e308e973cc501a225ce530
SHA1

f45ad3aa573afc629f5393f2518fa493467869a0
SHA256

182b6745f101b4b894a8ec2134639e220cc8dc14f5906c8bde0d2e9282e84af3
SHA512

75e42ceb884fa6c4d594b266e378b0cabfbcd01d223be0fd4ff3da53b8ea2cd3ab2511409a9fa6946b7f90474b493c325b065ca6c01ed2c7a479e0469fd627a1
SSDEEP

12288:oZsb2mXeuGeZVaHWxoZ+OeO+OeNhBBhhBBodIxMfYvxgBXTkVKhNTbosnZUwur:tb26euG0kgpgBXFrTM+Znu

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 956 wrote to memory of 1640	956	rundll32.exe	rundll32.exe
PID 956 wrote to memory of 1640	956	rundll32.exe	rundll32.exe
PID 956 wrote to memory of 1640	956	rundll32.exe	rundll32.exe
PID 956 wrote to memory of 1640	956	rundll32.exe	rundll32.exe
PID 956 wrote to memory of 1640	956	rundll32.exe	rundll32.exe
PID 956 wrote to memory of 1640	956	rundll32.exe	rundll32.exe
PID 956 wrote to memory of 1640	956	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DNF绝情阁模型工具\gj\exrpg.com\Bin32\ExtUtility.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:956

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DNF绝情阁模型工具\gj\exrpg.com\Bin32\ExtUtility.dll,#1
2⤵
PID:1640

memory/1640-54-0x0000000000000000-mapping.dmp

Download
memory/1640-55-0x00000000760E1000-0x00000000760E3000-memory.dmp

Filesize
8KB

Download