aa159c242c54988920ca64e521b5cb072e63b8970287c910a77efa403ae9155f

Analysis

max time kernel
185s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 16:40

Target

旺旺群发E客服版/dxwl_bh.dll
Size

62KB
MD5

9435c644ce28db438c050ebe544a0f0b
SHA1

882aa056c8dfb724b34037c95f7fd9f4ea59ecbd
SHA256

ca34dad6b2d447010c4436fb16a6ded53e9ee8111d0f6dad6359fc8717f5a24e
SHA512

222e5a7bb20965188962638b7ca1022a0fb0752ce181025615fcdec1e7447dde51d4cd946d0d68bcd270e8f21dacfea49b605c47b9b5b67bdcae1560219ea0d7
SSDEEP

768:xc3Vd8JIHm7urOgDrisnJmpu2uwh6dNt63r3jgr7ttOu6WPUHANCDXnkh99d+5:WFdHH9buQVq8w3jgPtv68Un6M5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1060 wrote to memory of 4820	1060	rundll32.exe	rundll32.exe
PID 1060 wrote to memory of 4820	1060	rundll32.exe	rundll32.exe
PID 1060 wrote to memory of 4820	1060	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\旺旺群发E客服版\dxwl_bh.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1060

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\旺旺群发E客服版\dxwl_bh.dll,#1
2⤵
PID:4820