a07062cb5e0bc9f8f7250ba9f1b1e81641c96b74659af89da2da28b983a8cef4

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 20:07

Target

XMTS20090628/程序功能/CHJ007.dll
Size

11KB
MD5

707b409316f0b24851750bd7bfa01cca
SHA1

49edad504031c2e8279e860f2d58723a4d65cae3
SHA256

272d943a0b6dd4558700490701589fd8c4ea45d2f83932b5ee5a72fe0afdb724
SHA512

082471cfd153ea3150ca2248d7469526388ebd6c5325e23b4068196cc4992def161e79f05a8c4b4943f8e66b41362c8ac201a9c23a15334ce87fde13a0458110
SSDEEP

192:n6nlThrhKMYrnuu5H2UE8x2AMAPiOYVgpYPmxn4Hhrw8q/a/qJ/P7A:crhIruu5HkgfMvVYYPmxwhO/aiV7

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2328	2308	rundll32.exe	28
PID 2308 wrote to memory of 2328	2308	rundll32.exe	28
PID 2308 wrote to memory of 2328	2308	rundll32.exe	28
PID 2308 wrote to memory of 2328	2308	rundll32.exe	28
PID 2308 wrote to memory of 2328	2308	rundll32.exe	28
PID 2308 wrote to memory of 2328	2308	rundll32.exe	28
PID 2308 wrote to memory of 2328	2308	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XMTS20090628\程序功能\CHJ007.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\XMTS20090628\程序功能\CHJ007.dll,#1
  2⤵
  PID:2328