51a9c6273d15a03c8cf9a75d9f25c9b1a094c8fc7ec2bd2654032f6dfad9c061

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 00:00

Target

零操作学校音乐铃声软件/XTRAS/AWMP3.dll
Size

68KB
MD5

ce942afc3415b1d6f588c64371795721
SHA1

258129fab7dd76c5f5f41f8b1b7702e0c2e63781
SHA256

092af393a8e01e8588cc0f427fff080126d0081fc923e4e2bfe3ea714cc43b6f
SHA512

11e148b03b1dd9db9eab941b14f3d055754d01a3607be64f7af840b4da5200435ad4bfe44b42576e758d5111cd0fad3cf2a9f9654b997985a4d634be03325c26
SSDEEP

768:Lad+/gC4fNzn6FWCld/qQTSAbsJf6ZiCZl6ViB9Su58lL6M65Dg2LokM1B:LfICkNKTSQTSgL43qScMQjo1B

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 2524	2800	rundll32.exe	14
PID 2800 wrote to memory of 2524	2800	rundll32.exe	14
PID 2800 wrote to memory of 2524	2800	rundll32.exe	14
PID 2800 wrote to memory of 2524	2800	rundll32.exe	14
PID 2800 wrote to memory of 2524	2800	rundll32.exe	14
PID 2800 wrote to memory of 2524	2800	rundll32.exe	14
PID 2800 wrote to memory of 2524	2800	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\零操作学校音乐铃声软件\XTRAS\AWMP3.dll,#1
1⤵
PID:2524

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\零操作学校音乐铃声软件\XTRAS\AWMP3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2800