bf176a4b8c3cec298fe69a631aca88f9ebf3a9757d53d9ca49e1ad0bf2d8a0e9

Analysis

max time kernel
43s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 04:54

Target

急速辅助免费版1223/前锋加速器1.6/shellEx.dll
Size

15KB
MD5

5f4afc670d0a649c3695227277a2aee9
SHA1

96dbde7cbf542079b1b9e210296c8d0fff144a80
SHA256

6e03f1b75ca538c1eb033d69433220d565c523498d518580eb3f88fc0d885075
SHA512

03c0817484b7677962c05bf6857d229cfe260039499f4e8a7d02811308b1aa7ccddf63a585607903bcf3989718311d83360cc27da4534236d6186e6085007a8d
SSDEEP

192:wlnW29PL7Mf7nEC384R4FklP3tmC1+Jzb14rvg24OVtx2de0J31oXz:wln3hLsEGb+WZz6b14+OUzzoXz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1468 wrote to memory of 1496	1468	rundll32.exe	rundll32.exe
PID 1468 wrote to memory of 1496	1468	rundll32.exe	rundll32.exe
PID 1468 wrote to memory of 1496	1468	rundll32.exe	rundll32.exe
PID 1468 wrote to memory of 1496	1468	rundll32.exe	rundll32.exe
PID 1468 wrote to memory of 1496	1468	rundll32.exe	rundll32.exe
PID 1468 wrote to memory of 1496	1468	rundll32.exe	rundll32.exe
PID 1468 wrote to memory of 1496	1468	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\急速辅助免费版1223\前锋加速器1.6\shellEx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\急速辅助免费版1223\前锋加速器1.6\shellEx.dll,#1
  2⤵
  PID:1496

memory/1496-54-0x0000000000000000-mapping.dmp

Download
memory/1496-55-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download