21d0ccf301cea644e3d885b66ea764085dfb147ff8323319aa2c9d0e50328ac6

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/02/2024, 18:39

Target

$PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/rc.dll
Size

369KB
MD5

a75aab3e55d19694dc896a17e4fe5cb4
SHA1

1d5bcdaf5bf213d22eb865f2ac90c4059c5c3e23
SHA256

b0b1f00b4cfebbed6772af28a7b89edd6c1786f671672cf0e476499e34dfbe33
SHA512

da41da1bbb97548dee9aa07b0a7cbdc11804dd770b46f94f4ed15637e4f9622c3987ea04ffc0e0a54b5272524197d4fb96251a74e390cb5c1a46bfdb1343e4b1
SSDEEP

3072:MekGhjt6n+DWOWfJe7Tqu4Xg4bZdOpFRcwJIpJ4f26LTTSIxt0j27dcliVs1UGui:taj5g4bZdOpFNJ8R27dVGbdoAT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 320 wrote to memory of 1804	320	rundll32.exe	28
PID 320 wrote to memory of 1804	320	rundll32.exe	28
PID 320 wrote to memory of 1804	320	rundll32.exe	28
PID 320 wrote to memory of 1804	320	rundll32.exe	28
PID 320 wrote to memory of 1804	320	rundll32.exe	28
PID 320 wrote to memory of 1804	320	rundll32.exe	28
PID 320 wrote to memory of 1804	320	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PROGRAM_FILES\Baidu\Toolbar\BaiduBarX_Tmp\rc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:320
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PROGRAM_FILES\Baidu\Toolbar\BaiduBarX_Tmp\rc.dll,#1
  2⤵
  PID:1804