08ccc4452d1dee6da9362d6e0a91a0ee02842a1bddb679d2cb3c267cb8a4860f

Analysis

max time kernel
115s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 09:07

Target

928免杀远控/iext2.dll
Size

492KB
MD5

dba5fdbe7ec94463b3f6fdf2162c9f95
SHA1

a97137b4f2b77166b2a23da1f58e0bdb7365f4f2
SHA256

a8b14f31098a191631696db5ddc77e029b48999542e0ec15b63df02220c66d37
SHA512

325439bb5fe0e18e08cd547e9e9d505aa5b1ee51a436cb155254cfb04d318679e7a016cc2e72ffaba49bed20e15e85b26fd2a22e726e211650317218dde53ba6
SSDEEP

6144:0ujp9xZF+ES6jisyHOzC8QxEksWINE1DfYmgykSjsUgZ43KyEBuXwKF:VZFX5zC8XkBIm1DfYml7otm3YBu

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5040 wrote to memory of 3824	5040	rundll32.exe	rundll32.exe
PID 5040 wrote to memory of 3824	5040	rundll32.exe	rundll32.exe
PID 5040 wrote to memory of 3824	5040	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\928免杀远控\iext2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5040

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\928免杀远控\iext2.dll,#1
2⤵
PID:3824