0123418ffeceaec339159113651a7f2bb502b64b25a34d812b27ff88e1e53db3

Analysis

max time kernel
39s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 07:18

Target

明月11.79/YXBOX.dll
Size

425KB
MD5

5c1427f6a24273bc5dfa9020ab73b351
SHA1

58efe46a6d9fe6593f645591e5609fc48cb8a833
SHA256

490bc43af0073d52d71c8d7528c71e16f9bae86f658a8fc88afe313096719e03
SHA512

e8e41ee688479db47c44c661c00dfdba41f3990ec8cdd2fdc641f37f3688ebc617510001661bdda4cb9ae84aab83e6647551154121ff2852ca136b724852afb6
SSDEEP

6144:D3YySn/l8mWgtJ7H36S+fk5Yn5mUak9EU601J1vye6omivb32gaWTEvWyItH2Szv:jYPFBJ7b+Mo5X9E10hDJ32nGEW5kU

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1708 wrote to memory of 1448	1708	rundll32.exe	rundll32.exe
PID 1708 wrote to memory of 1448	1708	rundll32.exe	rundll32.exe
PID 1708 wrote to memory of 1448	1708	rundll32.exe	rundll32.exe
PID 1708 wrote to memory of 1448	1708	rundll32.exe	rundll32.exe
PID 1708 wrote to memory of 1448	1708	rundll32.exe	rundll32.exe
PID 1708 wrote to memory of 1448	1708	rundll32.exe	rundll32.exe
PID 1708 wrote to memory of 1448	1708	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\明月11.79\YXBOX.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1708

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\明月11.79\YXBOX.dll,#1
2⤵
PID:1448

memory/1448-54-0x0000000000000000-mapping.dmp

Download
memory/1448-55-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/1448-56-0x0000000074B70000-0x0000000074C7B000-memory.dmp

Filesize
1.0MB

Download
memory/1448-58-0x0000000074C80000-0x0000000074D8B000-memory.dmp

Filesize
1.0MB

Download
memory/1448-59-0x0000000074B70000-0x0000000074C7B000-memory.dmp

Filesize
1.0MB

Download
memory/1448-60-0x0000000074C80000-0x0000000074D8B000-memory.dmp

Filesize
1.0MB

Download
memory/1448-61-0x0000000074B70000-0x0000000074C7B000-memory.dmp

Filesize
1.0MB

Download