49842b1e71ab037e48a822336cedde220b93e3fca667b7bd7c8cc9ec5489e49e

Analysis

max time kernel
188s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 19:23

Target

幻想辅助3/krnln.dll
Size

1.0MB
MD5

44e2ca67c060fbe3dc0d030149f5a478
SHA1

5df61eb626bc3849893701942114609c1086d496
SHA256

6ced19283dbbb95f264448f380592f4e98ba8228efca2f68821ab3ae61029d93
SHA512

1a348c7585d78dd68c1d0e059ea1d7cea57c1aeff734f834f75025719b9fdd0e9bb16aebe75e15502a1b83106387eaa9493b8990999e0a68b62c1afdbc8cf45e
SSDEEP

12288:rb0+sqCE6yy4bmhSd+1YCHYFZzktq0TNSARuOrRUVbNGvNXXYA/2b:AjE6+bhiHYF5kZI6uOrRUjYNXXYA/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 4392	3512	rundll32.exe	82
PID 3512 wrote to memory of 4392	3512	rundll32.exe	82
PID 3512 wrote to memory of 4392	3512	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\幻想辅助3\krnln.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\幻想辅助3\krnln.dll,#1
  2⤵
  PID:4392