256b2b603195d3c4a30c4c4ebd0db38859d0d0b2435d96005119b8f63fa6f410

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 06:45

Target

ͨͷQQӺ V.4.4 ʽ /HtmlView.dll
Size

212KB
MD5

f9a994df4d407bc79f7c84886fe7a654
SHA1

c93e4be70794164b7b339218cc832ac94074d08e
SHA256

2e9769ace867c79d5fcdda0eb2660c52b5e062c69b36add42d22eb0dddc4b3ee
SHA512

41b1333ed08c10aaef3d766fec2d6b2fa4c79001d7ce18a06918c2aa8c4ade69018522882bfd4543add31efbef5e7bb450511f80dc9b580eb022cb7c406a820e
SSDEEP

3072:16Is7zQckrcCmmIyREYf+le25zkSHAx9NnU7uJIgoPNH34pzGd1AOXu:16WmmZREYmpNCg9m0X

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1488	1960	rundll32.exe	28
PID 1960 wrote to memory of 1488	1960	rundll32.exe	28
PID 1960 wrote to memory of 1488	1960	rundll32.exe	28
PID 1960 wrote to memory of 1488	1960	rundll32.exe	28
PID 1960 wrote to memory of 1488	1960	rundll32.exe	28
PID 1960 wrote to memory of 1488	1960	rundll32.exe	28
PID 1960 wrote to memory of 1488	1960	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ͨͷQQӺ V.4.4 ʽ \HtmlView.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ͨͷQQӺ V.4.4 ʽ \HtmlView.dll",#1
  2⤵
  PID:1488

memory/1488-55-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

Filesize
8KB

Download