bf176a4b8c3cec298fe69a631aca88f9ebf3a9757d53d9ca49e1ad0bf2d8a0e9

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 04:54

Target

急速辅助免费版1223/前锋加速器1.6/TrayIcon.dll
Size

140KB
MD5

1548cd7015958acce440e704083bf501
SHA1

913b29d7b88198af99bb4c7e9bb002f4fbcfe985
SHA256

0d85e4868cb1df2c62b7919c6d2e647e55c9f8926047c31b5c288db48798c667
SHA512

dfe9e469fd364f69b86e919f72989eb7b47d61957cc17a489838870e5e9324aaf16c9888fdfb769a7ee91664679fc708b829a884944bede2876697f1d0948e58
SSDEEP

3072:enzrIRj4n7R+TdFf1JZJ/slebRj0rR6XsokExo1aIqb4rOapMZ8o:enP16FfbUebK1CapMp

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1052 wrote to memory of 1752	1052	rundll32.exe	rundll32.exe
PID 1052 wrote to memory of 1752	1052	rundll32.exe	rundll32.exe
PID 1052 wrote to memory of 1752	1052	rundll32.exe	rundll32.exe
PID 1052 wrote to memory of 1752	1052	rundll32.exe	rundll32.exe
PID 1052 wrote to memory of 1752	1052	rundll32.exe	rundll32.exe
PID 1052 wrote to memory of 1752	1052	rundll32.exe	rundll32.exe
PID 1052 wrote to memory of 1752	1052	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\急速辅助免费版1223\前锋加速器1.6\TrayIcon.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1052

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\急速辅助免费版1223\前锋加速器1.6\TrayIcon.dll,#1
2⤵
PID:1752

memory/1752-54-0x0000000000000000-mapping.dmp

Download
memory/1752-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download