a07062cb5e0bc9f8f7250ba9f1b1e81641c96b74659af89da2da28b983a8cef4

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 20:07

Target

XMTS20090628/程序功能/CHJ010.dll
Size

11KB
MD5

47797e287b035513d9e00c8f6d51537c
SHA1

8d0b568b21a837aafaf9fe0f6a2c7e49335be703
SHA256

74793a2c99e19087fc62d9eda89137abdba7b518a9d86417b1227f81728e9dd6
SHA512

449401b1127dd579b406791265b0279bb65e9964c6d1ce2f8be8d5d6e636c3aec51b54cea55592320fa699b5be794ed0962ae123e393aa83807d1a1b788e7b5f
SSDEEP

192:nIvqijC1qAnS530DlB2huL5zVyunkQRePTlttn0g9/X5gx:8bjwqAnzlouL5zVyukMoP0G/pg

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 3012	2228	rundll32.exe	28
PID 2228 wrote to memory of 3012	2228	rundll32.exe	28
PID 2228 wrote to memory of 3012	2228	rundll32.exe	28
PID 2228 wrote to memory of 3012	2228	rundll32.exe	28
PID 2228 wrote to memory of 3012	2228	rundll32.exe	28
PID 2228 wrote to memory of 3012	2228	rundll32.exe	28
PID 2228 wrote to memory of 3012	2228	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XMTS20090628\程序功能\CHJ010.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\XMTS20090628\程序功能\CHJ010.dll,#1
  2⤵
  PID:3012

memory/3012-0-0x0000000000110000-0x000000000011D000-memory.dmp

Filesize
52KB

Download
memory/3012-1-0x0000000000110000-0x000000000011D000-memory.dmp

Filesize
52KB

Download