1c307877b29bfa741b365fa9a05373160ad5bf98608de2a847a4b8231174d1de

Analysis

max time kernel
9s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 17:29

Target

qq_post1.4/Interop.ADODB.dll
Size

100KB
MD5

cd3a6224a31d0990694377d72ddffcf8
SHA1

4f8c9aaaffbe3fb862acc7be9918949e4941df50
SHA256

4a17ba10cee159d82b521046f49a5cc9c9ee1da668ae028fbf281861b292b991
SHA512

2e086559c41b25bd508f38d11d6485af45f14854655bb64e5bf9d69f544d4a9d4c6d92cfb10323f452724638cf703b5378fa6a08fe3ebe009dec2f7e72334441
SSDEEP

3072:czZAHCp0zu6IGlyPMJuDINT35+DNqOtS5z5j3KHrgMEi8:ctAHCp0zu6IGlyPMJuDItpENb8KLgd

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1028 wrote to memory of 888	1028	rundll32.exe	rundll32.exe
PID 1028 wrote to memory of 888	1028	rundll32.exe	rundll32.exe
PID 1028 wrote to memory of 888	1028	rundll32.exe	rundll32.exe
PID 1028 wrote to memory of 888	1028	rundll32.exe	rundll32.exe
PID 1028 wrote to memory of 888	1028	rundll32.exe	rundll32.exe
PID 1028 wrote to memory of 888	1028	rundll32.exe	rundll32.exe
PID 1028 wrote to memory of 888	1028	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\qq_post1.4\Interop.ADODB.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\qq_post1.4\Interop.ADODB.dll,#1
  2⤵
  PID:888

memory/888-54-0x0000000000000000-mapping.dmp

Download
memory/888-55-0x0000000075021000-0x0000000075023000-memory.dmp

Filesize
8KB

Download