657b2113c545a98733210f01cd3fecff8933a9da09c815ddb75792d22706d67c

Analysis

max time kernel
2s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 17:00

Target

身份证号码批量升级/shellEx.dll
Size

17KB
MD5

eb0c8e2234654a3095ec8d87fbf1a0f8
SHA1

9377bbe1e65971561a24b00c110c93b1c3adce39
SHA256

dc7c290ae15fecaf81eebfa952eb250f3fa35d329a3e771f85a2b3a8e31b83d0
SHA512

bac21fa19a01690a5b0128d413e59c600cd95744f05c6128a0089cc68dafe832a1b24ad59aa73d45cdad26b8c583a7a327e26cd8e9f16e010b25af5a4017b61b
SSDEEP

192:QiZGEugbRVYLHm1DlBpn1uX/84Q4V+vGgKvT+lvxLj3NlEz/eQxEdFIO6rtvn7:pZGYbRVYzwlBDuPbHVQGCv9jhCO0v7

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 976 wrote to memory of 964	976	rundll32.exe	rundll32.exe
PID 976 wrote to memory of 964	976	rundll32.exe	rundll32.exe
PID 976 wrote to memory of 964	976	rundll32.exe	rundll32.exe
PID 976 wrote to memory of 964	976	rundll32.exe	rundll32.exe
PID 976 wrote to memory of 964	976	rundll32.exe	rundll32.exe
PID 976 wrote to memory of 964	976	rundll32.exe	rundll32.exe
PID 976 wrote to memory of 964	976	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\身份证号码批量升级\shellEx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\身份证号码批量升级\shellEx.dll,#1
  2⤵
  PID:964

memory/964-54-0x0000000000000000-mapping.dmp

Download
memory/964-55-0x0000000075E61000-0x0000000075E63000-memory.dmp

Filesize
8KB

Download