794c7af6a850461230d5df6e2de755c9ce8489b9d46a4723eb313a56e2aadebd

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 16:02

Target

ƽ&ַʥ100Ԫĵ/˵/.res/ProcComm.dll
Size

1.1MB
MD5

b2a1a796fb8a33b051ae560d30b74e8e
SHA1

b06f169055605ff9faec3545e36eeccfa22da42a
SHA256

05176ca81fdcc507b4fb1de01f56234a5370a730e2c2187bf3e6da3df9a9ac29
SHA512

b77ed9cc349e6e417ba6c55828f9a595972d5f9014a0d349e4e3e43453b378f5c239eeb3b4e8ebf0090c2b79f5632a604280c41d707a773a4fb9e3f17cff5269
SSDEEP

24576:cMaCIDDHcXbZ+chP+Rur0Driyhpuec/iSXhAfqowx:daCGHYd2Duy1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2532 wrote to memory of 2188	2532	rundll32.exe	rundll32.exe
PID 2532 wrote to memory of 2188	2532	rundll32.exe	rundll32.exe
PID 2532 wrote to memory of 2188	2532	rundll32.exe	rundll32.exe
PID 2532 wrote to memory of 2188	2532	rundll32.exe	rundll32.exe
PID 2532 wrote to memory of 2188	2532	rundll32.exe	rundll32.exe
PID 2532 wrote to memory of 2188	2532	rundll32.exe	rundll32.exe
PID 2532 wrote to memory of 2188	2532	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ƽ&ַʥ100Ԫĵ\˵\.res\ProcComm.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ƽ&ַʥ100Ԫĵ\˵\.res\ProcComm.dll,#1
  2⤵
  PID:2188