a07062cb5e0bc9f8f7250ba9f1b1e81641c96b74659af89da2da28b983a8cef4

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 20:07

Target

XMTS20090628/程序功能/CHJ006.dll
Size

187KB
MD5

c21b9949e8bd3499c2188ae43cce1ad7
SHA1

3108e38fd6988d96a45d49dfa1c8ecac2478cf01
SHA256

2b952802c039114d51ba67078acb37e8d4ee4e91afc26602aad2db93c5ac23a7
SHA512

3cd26aeed0adedb609532a49ee3e0f22a9dc6e1bc9c08f127356801634d754605292e4bc0bf3dfa87a86c24df714f9057f39a999eda70ee283183e5905663374
SSDEEP

3072:7OZ88571r5o7PUsWp59wFsgvPDfRRoFjRo5hBcep8adjRPmt1CA:7Orjr5qPUjFwFBvPNRoVR+cadjRPm

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2864	2416	rundll32.exe	18
PID 2416 wrote to memory of 2864	2416	rundll32.exe	18
PID 2416 wrote to memory of 2864	2416	rundll32.exe	18
PID 2416 wrote to memory of 2864	2416	rundll32.exe	18
PID 2416 wrote to memory of 2864	2416	rundll32.exe	18
PID 2416 wrote to memory of 2864	2416	rundll32.exe	18
PID 2416 wrote to memory of 2864	2416	rundll32.exe	18

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XMTS20090628\程序功能\CHJ006.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\XMTS20090628\程序功能\CHJ006.dll,#1
  2⤵
  PID:2864