51a9c6273d15a03c8cf9a75d9f25c9b1a094c8fc7ec2bd2654032f6dfad9c061

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 00:00

Target

零操作学校音乐铃声软件/XTRAS/SWADCMPR.dll
Size

95KB
MD5

81c89ce4461f58a46d550b6753b29ea7
SHA1

d88d4ce25183dd3cf48fe36d4e334f5fe075bfa9
SHA256

a3a0f90acf62598b29bbe932f4447c3ffd8c5929580e93239e42627282470e87
SHA512

bcf3d84c4be548c9c7a84b214f5465738f577286daaf46431e5f12edeede0b2fefa96b24922edcadbaf3e8e97f0b4325e3619a6ec817fafdf925621430bb8e47
SSDEEP

1536:KhlZCqoBcEdDvjDjQlv8GpJO0lDFW2JUB2BJv7rSCM6RClb2dd8SUj:QGdLrKDpJtlDFdNHSoCt2dd8tj

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 1636	1344	rundll32.exe	16
PID 1344 wrote to memory of 1636	1344	rundll32.exe	16
PID 1344 wrote to memory of 1636	1344	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\零操作学校音乐铃声软件\XTRAS\SWADCMPR.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\零操作学校音乐铃声软件\XTRAS\SWADCMPR.dll,#1
  2⤵
  PID:1636