8e0e38ed2f8c46569c0b1d250f3e66b190d256a7fa0824bd5d3e8bf215fb5ce2

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 22:24

Target

rxbaoV3.29_Y/xplib.dll
Size

80KB
MD5

8f385e7c8cf1f8ebdae0448473977cc7
SHA1

942bf465e29a5e5f85580eb30aa9510b92f802d7
SHA256

d1a1c6bac6a498adccdafab9d600a372aa9d5b826a33cfa06aaa9f75357c5b23
SHA512

2372a8857591b829763cacbdfc0cf3d4884598c5f1c43f0815257cb7fb3b2c93b60b1027480e1d5a93bbc6eba054328d8d2b4997c7d81a5360811f8f1eecafa1
SSDEEP

768:25tYWNgMBrw1cbmKrvtt9AK+HSTGwBtL9hlkU8MiP+cTqp2DYGH+toh+z9:25tY2BEe/CSTGOfqqLSCoQ9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1968 wrote to memory of 892	1968	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 892	1968	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 892	1968	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 892	1968	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 892	1968	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 892	1968	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 892	1968	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\rxbaoV3.29_Y\xplib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\rxbaoV3.29_Y\xplib.dll,#1
  2⤵
  PID:892

memory/892-54-0x0000000000000000-mapping.dmp

Download
memory/892-55-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download