8272912ee1bf16a05192042253c37356e5944c0e26795772a14c606565ca58b6

Analysis

max time kernel
172s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 09:05

Target

YY5331过非法VE/dak32.dll
Size

106KB
MD5

0463cef2cd6017443a1773752323c79d
SHA1

40699ecda75219ced7f4a23af2399e738b9d1a25
SHA256

b2a043e5ae68c58f6f281485869b87270377ed89e8937a5da669f8c107c278be
SHA512

1a83dbf7732f8f8ee4daa5ea4511844a03c99fd1e11bca0ffff284995458554de4612579cb42683bf02af619de3e47091108fcaab69d3f6997819f0ca35fe4b2
SSDEEP

1536:7BQgyJrXNuMPB5JSxCAG6S0Hg3fQ9WTsKrfkvDiP9an/mtZnI:lQgyJrXNumLAVS0A3o9WTsAfkvUDnI

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 1184	2064	rundll32.exe	87
PID 2064 wrote to memory of 1184	2064	rundll32.exe	87
PID 2064 wrote to memory of 1184	2064	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\YY5331过非法VE\dak32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\YY5331过非法VE\dak32.dll,#1
  2⤵
  PID:1184