27784f24a8d0b693b96e57355c6eab3e56f2b6909cf74154393fdb6ee9ac6d17

Analysis

max time kernel
133s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 18:37

Target

冰封免费版(请关闭杀毒软件下载)/Dll.dll
Size

7KB
MD5

0bbbca7038095d2ca8eff205bb1c7210
SHA1

af89fc4b2dfbfd0a0ce464a171c78009f7caf1b6
SHA256

3b4869d560062b4ea0edd78fba1d798a403b8749a9b32d323058e7e6416ee53e
SHA512

2870cbf3eb75b3812f502b6ab5adae543349b02eb8e62ec1531d0464c9d475e69d4a9e6773a237dc7616f5754ef255903d976cf7d7a5d55e5b2b5043112595d7
SSDEEP

96:yWf0YDrMtyjnyoSvDilH2tBOMrJQOBdFC+orPT3XAUPVAF6GDTnECt6M7N:5iy+o4DiwBOxO2rr3XHPV26Onf6A

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4936 wrote to memory of 1456	4936	rundll32.exe	rundll32.exe
PID 4936 wrote to memory of 1456	4936	rundll32.exe	rundll32.exe
PID 4936 wrote to memory of 1456	4936	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\冰封免费版(请关闭杀毒软件下载)\Dll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\冰封免费版(请关闭杀毒软件下载)\Dll.dll,#1
  2⤵
  PID:1456