1c307877b29bfa741b365fa9a05373160ad5bf98608de2a847a4b8231174d1de

Analysis

max time kernel
9s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 17:29

Target

qq_post1.4/Interop.ADOX.dll
Size

36KB
MD5

5d99e31fa7c1975e063d47bb215ddcd0
SHA1

e300962fd2b52783efd041c09d864ae42fee2c9e
SHA256

c653bea8fc6832db4c74875077c831ec3d3d236886204dd0f2e496323be651ed
SHA512

7d60df7948335ec293f49b529f144813fb5333fa69ad660e92234eb9865a7244737240192792f762fdcf236e217693278f0094dacba73f28b35b6435b0f75426
SSDEEP

384:cWECTVueWzFsXyVH50bSIDxmNiJ1hYy4x6LoRfKZwX7Th6wWrniII8mH71/:cWbVuejXQHdkiiJ1G7RfKZwXd

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1204 wrote to memory of 1228	1204	rundll32.exe	rundll32.exe
PID 1204 wrote to memory of 1228	1204	rundll32.exe	rundll32.exe
PID 1204 wrote to memory of 1228	1204	rundll32.exe	rundll32.exe
PID 1204 wrote to memory of 1228	1204	rundll32.exe	rundll32.exe
PID 1204 wrote to memory of 1228	1204	rundll32.exe	rundll32.exe
PID 1204 wrote to memory of 1228	1204	rundll32.exe	rundll32.exe
PID 1204 wrote to memory of 1228	1204	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\qq_post1.4\Interop.ADOX.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1204

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\qq_post1.4\Interop.ADOX.dll,#1
2⤵
PID:1228

memory/1228-54-0x0000000000000000-mapping.dmp

Download
memory/1228-55-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download