ac50a2f233bed117ea4aab2ec0437e1d04661664f24f1a59cfd29c9fad16f77a

Analysis

max time kernel
69s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 21:10

Target

mxdbl.pc6.0831/冒险伴侣0831/bldllw32.dll
Size

650KB
MD5

cf7c6b37887a7fae3f46860579ad7b0b
SHA1

9f45a4d9cb15df425a950ca202824dbeb4b724d5
SHA256

35d44ee1cac624e139bb7998e40cef0e489a33879f21ae793144b0acec470010
SHA512

53b8a8a0d1fbb2187e05e90f8bae204a0a50e42088447cfdf08d146f41054e003f55e592853a8fccf8001cde248043878c39b99b5eb951bba17629c36d76795f
SSDEEP

12288:zx3pZ7zW9bajGmYnj3vTWLOG1MED4Pftt1iTC6Fi:zx3pZ7uOGVnzBOlD43NOC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 460 wrote to memory of 592	460	rundll32.exe	rundll32.exe
PID 460 wrote to memory of 592	460	rundll32.exe	rundll32.exe
PID 460 wrote to memory of 592	460	rundll32.exe	rundll32.exe
PID 460 wrote to memory of 592	460	rundll32.exe	rundll32.exe
PID 460 wrote to memory of 592	460	rundll32.exe	rundll32.exe
PID 460 wrote to memory of 592	460	rundll32.exe	rundll32.exe
PID 460 wrote to memory of 592	460	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mxdbl.pc6.0831\冒险伴侣0831\bldllw32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:460

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mxdbl.pc6.0831\冒险伴侣0831\bldllw32.dll,#1
2⤵
PID:592

memory/592-54-0x0000000000000000-mapping.dmp

Download
memory/592-55-0x00000000761E1000-0x00000000761E3000-memory.dmp

Filesize
8KB

Download