c2d7bd36651438dc46e8519dcaccff7fbbe838ee3e9b7f875893c7cf9a3493a1

Analysis

max time kernel
161s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 00:59

Target

hxsyfzgj_56086/YY幻想神域辅助0804/krnln.dll
Size

1.0MB
MD5

44e2ca67c060fbe3dc0d030149f5a478
SHA1

5df61eb626bc3849893701942114609c1086d496
SHA256

6ced19283dbbb95f264448f380592f4e98ba8228efca2f68821ab3ae61029d93
SHA512

1a348c7585d78dd68c1d0e059ea1d7cea57c1aeff734f834f75025719b9fdd0e9bb16aebe75e15502a1b83106387eaa9493b8990999e0a68b62c1afdbc8cf45e
SSDEEP

12288:rb0+sqCE6yy4bmhSd+1YCHYFZzktq0TNSARuOrRUVbNGvNXXYA/2b:AjE6+bhiHYF5kZI6uOrRUjYNXXYA/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 3376	2648	rundll32.exe	81
PID 2648 wrote to memory of 3376	2648	rundll32.exe	81
PID 2648 wrote to memory of 3376	2648	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hxsyfzgj_56086\YY幻想神域辅助0804\krnln.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\hxsyfzgj_56086\YY幻想神域辅助0804\krnln.dll,#1
  2⤵
  PID:3376