7f4af8bf6568d684df93719bb2c64588ac3117885f07bdb7c46ce1d981a71013

Analysis

max time kernel
122s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 01:14

Target

数码照片管理系统(发布)/ijl11.dll
Size

176KB
MD5

a0ce0247d48fecaac607edb1e2d87fd8
SHA1

346bf586bdf6ae4181c685fa74adf4524328d469
SHA256

5a0b1c4e5d91fd67a1ad23e5ce869899b79a7282cb6e5533dc5c074eb59306ec
SHA512

38a03530dfafe3030ece87dad7af28baff8e79f87618f1510bcb5b7f994632745dc70f9062ba6bdbcd408062786bbb3c37a53c21423d1f172663d9e57c232986
SSDEEP

3072:RsZ/nXwWIsHJah2s6ozRcYJi8HqC+B+x/Q67u/TIrnVlm77qYFh5ZKhL3DcOgJ06:Re/XwWIOJsK/sroqYX54Lz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2616	2156	rundll32.exe	27
PID 2156 wrote to memory of 2616	2156	rundll32.exe	27
PID 2156 wrote to memory of 2616	2156	rundll32.exe	27
PID 2156 wrote to memory of 2616	2156	rundll32.exe	27
PID 2156 wrote to memory of 2616	2156	rundll32.exe	27
PID 2156 wrote to memory of 2616	2156	rundll32.exe	27
PID 2156 wrote to memory of 2616	2156	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\数码照片管理系统(发布)\ijl11.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\数码照片管理系统(发布)\ijl11.dll,#1
  2⤵
  PID:2616