256b2b603195d3c4a30c4c4ebd0db38859d0d0b2435d96005119b8f63fa6f410

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 06:45

Target

ͨͷQQӺ V.4.4 ʽ /UUWiseHelper.dll
Size

284KB
MD5

dc6b73cbd1f6f5cec640a8c634ae50c8
SHA1

b83fd1c83c4bf4e9cb9339026bd877f11a72fc1f
SHA256

3148d4ce90265cf69bc75c62f5c3988c69c944803efd0092dc3499ac3c940c3a
SHA512

39ea04686c1688fc6de85949b65caec0380e322952de28f86da53d2ed628bf601834c19ec3e57aab74a7566b4e53ec325967cdc71827c0f678887314047162e7
SSDEEP

6144:kdMZ8iS+i99HLodnlw0jqXP5leLhsA7rQ1:2+i99rofw0jqXRleti1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 864	1504	rundll32.exe	28
PID 1504 wrote to memory of 864	1504	rundll32.exe	28
PID 1504 wrote to memory of 864	1504	rundll32.exe	28
PID 1504 wrote to memory of 864	1504	rundll32.exe	28
PID 1504 wrote to memory of 864	1504	rundll32.exe	28
PID 1504 wrote to memory of 864	1504	rundll32.exe	28
PID 1504 wrote to memory of 864	1504	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ͨͷQQӺ V.4.4 ʽ \UUWiseHelper.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ͨͷQQӺ V.4.4 ʽ \UUWiseHelper.dll",#1
  2⤵
  PID:864

memory/864-55-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

Filesize
8KB

Download