4e45113bdfa91deb6cddf6579f40a2471ce152e3fb4b934ccae1a207a1cad724

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 08:41

Target

变速精灵2.11免费版/BException.dll
Size

7KB
MD5

00a9f8cc6fb5766e2b303e129d3ca96a
SHA1

52cd862b2c88b90b357fbece693a6d19cff656a7
SHA256

7c6323205b69d6c3f95e1989dac6f7cf4a4aa66625a6b626085caa71372dedf8
SHA512

bef2606d181b0513157d5cdd8855ff6155f1c23b3e9c0d8b67a1f55238f471764a727dcde4e237d5c1da0dcd977cb2f1e91634c592806f02f164757280f07f07
SSDEEP

96:91zQ9iVDjkH0/s68dwJnAc7Tbuxuwb3fmqPQbAHoAxVmTzUuNTnT:9RQefG0/s61JAcTburJIRTzUQT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 1480	1448	rundll32.exe	27
PID 1448 wrote to memory of 1480	1448	rundll32.exe	27
PID 1448 wrote to memory of 1480	1448	rundll32.exe	27
PID 1448 wrote to memory of 1480	1448	rundll32.exe	27
PID 1448 wrote to memory of 1480	1448	rundll32.exe	27
PID 1448 wrote to memory of 1480	1448	rundll32.exe	27
PID 1448 wrote to memory of 1480	1448	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\变速精灵2.11免费版\BException.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\变速精灵2.11免费版\BException.dll,#1
  2⤵
  PID:1480

memory/1480-54-0x0000000000000000-mapping.dmp

Download
memory/1480-55-0x00000000758B1000-0x00000000758B3000-memory.dmp

Filesize
8KB

Download