1284396c6f7a5d88d4d3eddfe28d751c54fa8763554c669e83c05d927702b053

Analysis

max time kernel
29s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 06:57

Target

QQ群批量拉人软件2.1/UUWisehelper.dll
Size

118KB
MD5

2725e51ac1906b999c81319aa4cb0c45
SHA1

babe7f11c5af056a0a569c1a982478ac698aea6c
SHA256

0aa6ca66a683b6e8baf78f2d5e91a016e3a6fb5470d42080d39ca43c03f2f3ba
SHA512

2af4679579dc077977060c4ca2ec1f562affb2492e8b4f2dd965948090c105b49d93ecee28374c2fc1a29df00a090c223b1e424841ec702d256923c42bb0a1dc
SSDEEP

1536:czR/k08QIGChujtNVEmFKg9v4ReW92eX80OjvI/eKB4njUS5Dc1L:cl/k08fG0cK0BUBygdBjS5Dc1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1516 wrote to memory of 1776	1516	rundll32.exe	rundll32.exe
PID 1516 wrote to memory of 1776	1516	rundll32.exe	rundll32.exe
PID 1516 wrote to memory of 1776	1516	rundll32.exe	rundll32.exe
PID 1516 wrote to memory of 1776	1516	rundll32.exe	rundll32.exe
PID 1516 wrote to memory of 1776	1516	rundll32.exe	rundll32.exe
PID 1516 wrote to memory of 1776	1516	rundll32.exe	rundll32.exe
PID 1516 wrote to memory of 1776	1516	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQ群批量拉人软件2.1\UUWisehelper.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1516

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQ群批量拉人软件2.1\UUWisehelper.dll,#1
2⤵
PID:1776

memory/1776-54-0x0000000000000000-mapping.dmp

Download
memory/1776-55-0x0000000075F01000-0x0000000075F03000-memory.dmp

Filesize
8KB

Download