81cdfab0e7191b1738a67fa50dd3f7aea019c8eb34c017d6dbb54e42329a403c

Analysis

max time kernel
206s
max time network
227s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 05:24

Target

VCF通讯录编辑器/comctl32.dll
Size

603KB
MD5

f03851b900c688667e1bf30ab48be3c9
SHA1

ea8068786c790b98bd24502b9f03c22e9d8d4a6b
SHA256

b45e8b05b4e8d00f96587b2323c0ae2da6cd00beded448b775ecd8373194d2fe
SHA512

8acd4afe2063db1b315b9edd8390a481bd1f786d399299468e8ee319eb25808f7d1b4c2a11e3b32318f06dbe9c5923457918e624b1fbdee6b27afe205baa667f
SSDEEP

12288:EEZmiSRZKGdxzaeruiWNZvC2HLNe1o1990GKa6o/VA+pPxHEGS+GVxrwP+RVovwa:EEZmiS7bP+erDK6sLmofKa6o9AQRVZ0w

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3856 wrote to memory of 4148	3856	rundll32.exe	86
PID 3856 wrote to memory of 4148	3856	rundll32.exe	86
PID 3856 wrote to memory of 4148	3856	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VCF通讯录编辑器\comctl32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\VCF通讯录编辑器\comctl32.dll,#1
  2⤵
  PID:4148