a07062cb5e0bc9f8f7250ba9f1b1e81641c96b74659af89da2da28b983a8cef4

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 20:07

Target

XMTS20090628/程序功能/CHJ005.dll
Size

11KB
MD5

cf96cf41747c1370932645c91ae91497
SHA1

c702aea5e2f23269c2d2796c00a8c4df22e762d2
SHA256

94e656ce870fce361a2dda9689cbaf2a060797fb15a594100c690386caa0f9cb
SHA512

b27d4955513df1dc224edb10297de1516e2a59cac1e42936cdcaa4b0a2313ad4611e11340cc57a54dc6262c8ee9956b2c1e41f3fb3ff660dc7a78bba97f972fa
SSDEEP

192:nflThrhKMYrnuu5H2UE8x2AMAPiOYVgpYPmxn4Hhrw84xKbVvbaA:/rhIruu5HkgfMvVYYPmxwh4KJDa

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1108	1204	rundll32.exe	28
PID 1204 wrote to memory of 1108	1204	rundll32.exe	28
PID 1204 wrote to memory of 1108	1204	rundll32.exe	28
PID 1204 wrote to memory of 1108	1204	rundll32.exe	28
PID 1204 wrote to memory of 1108	1204	rundll32.exe	28
PID 1204 wrote to memory of 1108	1204	rundll32.exe	28
PID 1204 wrote to memory of 1108	1204	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XMTS20090628\程序功能\CHJ005.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\XMTS20090628\程序功能\CHJ005.dll,#1
  2⤵
  PID:1108

memory/1108-0-0x0000000000150000-0x000000000015D000-memory.dmp

Filesize
52KB

Download