ca493000c5eaff8432d6e2f3fc11a35fc019f1ff30806c661fba26e9941b5fb7

Analysis

max time kernel
127s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 09:55

Target
GongShaFuZhu13/【x1】攻沙辅助/cfgdll.dll
Size 59KB
Sample240110-lxswpaebc5
SHA256 767b2e735693a9455a23b19e7a94643fd6095fa1158cbe22f612d657ebbb670d
MD5 929f56b46242fa68a616374a5403689b
SHA1 45b4ade1f0cc2bf13e74d9801eee5c7abee3c3b2
SHA512 81c69649efff9d320533bcb3256d42c671877e1d48f9df99134c514aa2d888d11ded13b9d3447949881513e376cf4644b41b997cad2a9ffb51f4f45ca3cdc641
SSDEEP 768:eaEHTGEBv6OuJjxqbhJKOBGxoVlbP2nP8oMRIEw8q:eHHTG7OuJjsKOBlVh+EoMjw8q
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1392	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 1392	4600	rundll32.exe	90
PID 4600 wrote to memory of 1392	4600	rundll32.exe	90
PID 4600 wrote to memory of 1392	4600	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GongShaFuZhu13\【x1】攻沙辅助\cfgdll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\GongShaFuZhu13\【x1】攻沙辅助\cfgdll.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1392