9eef6e2d4e5d2511a3fb86645bc5ae5d239a58da5b5650470a5deece1c731668

Analysis

max time kernel
114s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 21:22

Target

傳奇守護者免费版1.8.9/detection/tempj/InjDuck.dll
Size

187KB
MD5

4ac7e68243f06cc27fdf55c225b9f04c
SHA1

4e11ec30fcc29c4dbecbb7def16ada567f3d222c
SHA256

724975eed2b5153760d3ea82fa2973fedd56b912b453bc081d07d6b8ef70ce47
SHA512

0f9fd68ac7f9b39d984ad2fcb2d7e18d4738bc350e341aa42a8e8a934d5229c4efec85e146c2339c5091bf765c3e506207ba265e039635b24e60a79b0f9cf244
SSDEEP

3072:9V10KsmH1QY0t9QHIDbrsnxFX4mTjAfVsxSGyHkiTK5shm/i9Lsj3:9H0Ksm+Jt9QHkbInLX4mesxSGyE0PhG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1740 wrote to memory of 628	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 628	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 628	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 628	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 628	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 628	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 628	1740	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\傳奇守護者免费版1.8.9\detection\tempj\InjDuck.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1740

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\傳奇守護者免费版1.8.9\detection\tempj\InjDuck.dll,#1
2⤵
PID:628

memory/628-54-0x0000000000000000-mapping.dmp

Download
memory/628-55-0x00000000767F1000-0x00000000767F3000-memory.dmp

Filesize
8KB

Download