6d32c71e93ff0ecd5b27019a75c6c1af2af4183fa1d923bed5df6f61c2934018

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 14:45

Target

fhxy hook V0.3__/fhxy hook V0.3公开/fhxy.dll
Size

174KB
MD5

7619538fafbea49993476c73aebb340a
SHA1

52e528073d4b33ce2f4738171e435dba5efc001c
SHA256

c8c34905a614494a4e2805cf7433f4e4c60730d83b9c0ba5696b8ac1e36af553
SHA512

f5e29a9295f4ec53ed952b55fed4b2ce63a04dc91433ed8c338215ae1c6cb826382416016e4f48112bba56f864907c7c25b0732e6f6518d72e0b5f94929e5ada
SSDEEP

3072:X2FvntDrOCD+pcur2E8BQP/elrupk99IO6yQMbXmOoP5dK70qE0RNSGBxNzBt3nh:X2RtDYcurfelGNO6KbXYA0qEqSAxNzBf

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2184	1996	rundll32.exe	28
PID 1996 wrote to memory of 2184	1996	rundll32.exe	28
PID 1996 wrote to memory of 2184	1996	rundll32.exe	28
PID 1996 wrote to memory of 2184	1996	rundll32.exe	28
PID 1996 wrote to memory of 2184	1996	rundll32.exe	28
PID 1996 wrote to memory of 2184	1996	rundll32.exe	28
PID 1996 wrote to memory of 2184	1996	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\fhxy hook V0.3__\fhxy hook V0.3公开\fhxy.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\fhxy hook V0.3__\fhxy hook V0.3公开\fhxy.dll",#1
  2⤵
  PID:2184

memory/2184-0-0x0000000010000000-0x000000001010B000-memory.dmp

Filesize
1.0MB

Download
memory/2184-1-0x0000000010000000-0x000000001010B000-memory.dmp

Filesize
1.0MB

Download