bf176a4b8c3cec298fe69a631aca88f9ebf3a9757d53d9ca49e1ad0bf2d8a0e9

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 04:54

Target

急速辅助免费版1223/前锋加速器1.6/shell.dll
Size

64KB
MD5

988ba9752ab28801bc4ac4d781c5c9ce
SHA1

b3de1fc6829e1a048e769bad402e374358de2f61
SHA256

1269a719d453bf71db23ad73492a6098b725c8f6a0321144e77bccc3826bdb71
SHA512

088cbebc1c9dc890160ba8eff654a2ce80158c15d4323ad31339535ee1bf6d1d8454a9686cb8d90e867e0e745b69d0cbca1b2fd4fc8fdf6555deda92ddfe60c2
SSDEEP

768:tVNkZI5I+ElRkM+tJO7NhZfGTTsd8ZxqEHVgmFj9og6/HrWd+bJFd:fNkflR0UT0TsSZxH17on/aaJF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3656 wrote to memory of 4040	3656	rundll32.exe	rundll32.exe
PID 3656 wrote to memory of 4040	3656	rundll32.exe	rundll32.exe
PID 3656 wrote to memory of 4040	3656	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\急速辅助免费版1223\前锋加速器1.6\shell.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\急速辅助免费版1223\前锋加速器1.6\shell.dll,#1
  2⤵
  PID:4040

memory/4040-132-0x0000000000000000-mapping.dmp

Download
memory/4040-133-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download