27784f24a8d0b693b96e57355c6eab3e56f2b6909cf74154393fdb6ee9ac6d17

Analysis

max time kernel
21s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 18:37

Target

冰封免费版(请关闭杀毒软件下载)/GetInfo.dll
Size

1.5MB
MD5

dbac2c9c7545463a542820337e504dd4
SHA1

f1927a37103145678bffefd2437d3c18a9b68831
SHA256

ef022b706eab8542d2cf3be7de64b66cb809509732b08f6e055abeb84bdbba48
SHA512

298dca7f6a9b9557305d435463063b421285d2420f581f28770ffb837dee55ae7ab99547bbd5e4d80da7958d1eb259f0d3c8262bbbd71517d89a0de47795d384
SSDEEP

49152:7wZEkRqxYYYGkMzgBss/g6hIOd9uZNMcC8CFyluyplN1vn:QEnxdHkMz8ss/g6hISuzvCFysyplN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1020 wrote to memory of 1912	1020	rundll32.exe	rundll32.exe
PID 1020 wrote to memory of 1912	1020	rundll32.exe	rundll32.exe
PID 1020 wrote to memory of 1912	1020	rundll32.exe	rundll32.exe
PID 1020 wrote to memory of 1912	1020	rundll32.exe	rundll32.exe
PID 1020 wrote to memory of 1912	1020	rundll32.exe	rundll32.exe
PID 1020 wrote to memory of 1912	1020	rundll32.exe	rundll32.exe
PID 1020 wrote to memory of 1912	1020	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\冰封免费版(请关闭杀毒软件下载)\GetInfo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\冰封免费版(请关闭杀毒软件下载)\GetInfo.dll,#1
  2⤵
  PID:1912

memory/1912-54-0x0000000000000000-mapping.dmp

Download
memory/1912-55-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download