256b2b603195d3c4a30c4c4ebd0db38859d0d0b2435d96005119b8f63fa6f410

Analysis

max time kernel
144s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 06:45

Target

ͨͷQQӺ V.4.4 ʽ /HtmlView.dll
Size

212KB
MD5

f9a994df4d407bc79f7c84886fe7a654
SHA1

c93e4be70794164b7b339218cc832ac94074d08e
SHA256

2e9769ace867c79d5fcdda0eb2660c52b5e062c69b36add42d22eb0dddc4b3ee
SHA512

41b1333ed08c10aaef3d766fec2d6b2fa4c79001d7ce18a06918c2aa8c4ade69018522882bfd4543add31efbef5e7bb450511f80dc9b580eb022cb7c406a820e
SSDEEP

3072:16Is7zQckrcCmmIyREYf+le25zkSHAx9NnU7uJIgoPNH34pzGd1AOXu:16WmmZREYmpNCg9m0X

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 5112	4776	rundll32.exe	80
PID 4776 wrote to memory of 5112	4776	rundll32.exe	80
PID 4776 wrote to memory of 5112	4776	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ͨͷQQӺ V.4.4 ʽ \HtmlView.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ͨͷQQӺ V.4.4 ʽ \HtmlView.dll",#1
  2⤵
  PID:5112