256b2b603195d3c4a30c4c4ebd0db38859d0d0b2435d96005119b8f63fa6f410

Analysis

max time kernel
34s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 06:45

Target

ͨͷQQӺ V.4.4 ʽ /iext.dll
Size

204KB
MD5

856495a1605bfc7f62086d482b502c6f
SHA1

86ecc67a784bc69157d664850d489aab64f5f912
SHA256

8c8254cb49f7287b97c7f952c81edabc9f11f3fa3f02f265e67d5741998cf0bf
SHA512

35a6e580cd362c64f1e1f9c3439660bd980ec437bd8cabbdc49479ceb833cd8cb6c82d2fb747516d5cfcf2af0ba540bc01640171fbe3b4d0e0a3eeeaa69dd1d9
SSDEEP

3072:qOs+pOZXaFAO0shQe9lkvelFv76OD5KoUThiL5t3gIn:C+0cB+vebJ6iLTF

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 1956	1476	rundll32.exe	27
PID 1476 wrote to memory of 1956	1476	rundll32.exe	27
PID 1476 wrote to memory of 1956	1476	rundll32.exe	27
PID 1476 wrote to memory of 1956	1476	rundll32.exe	27
PID 1476 wrote to memory of 1956	1476	rundll32.exe	27
PID 1476 wrote to memory of 1956	1476	rundll32.exe	27
PID 1476 wrote to memory of 1956	1476	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ͨͷQQӺ V.4.4 ʽ \iext.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ͨͷQQӺ V.4.4 ʽ \iext.dll",#1
  2⤵
  PID:1956

memory/1956-55-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download