f6de40a0e0c5b51daa70456189d10f7fc1e7dcd36168cf8afcb17035efda6686

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
16/03/2024, 10:26

Target

$PLUGINSDIR/WeChatInstallDll.dll
Size

3.6MB
MD5

91153d3fc0b835b072aeebc4d8837faf
SHA1

1e1e524be7c69077229973e385c447d9692ad937
SHA256

a7971bce47584535e9033f9d72d8f6f386c7d8deef3b93e11de50cf9574f7413
SHA512

2b49c6d701cc6f0d25a81258dcec2159ab3ea30389d18aadcc486c540f5daf6adedf998def1bf5c5fb4a5712755dbca710387c862a89138b23ec081682e835ec
SSDEEP

49152:IBTaBlUSRRWRgyuHaLF12pv55EW4AXO/hPsQIYmSXyfgY2YBlWPRGtTLJMK+u8GJ:IBTaBzIguwv/ShTXyfgClmG13+dTW

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2928	2932	rundll32.exe	28
PID 2932 wrote to memory of 2928	2932	rundll32.exe	28
PID 2932 wrote to memory of 2928	2932	rundll32.exe	28
PID 2932 wrote to memory of 2928	2932	rundll32.exe	28
PID 2932 wrote to memory of 2928	2932	rundll32.exe	28
PID 2932 wrote to memory of 2928	2932	rundll32.exe	28
PID 2932 wrote to memory of 2928	2932	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WeChatInstallDll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WeChatInstallDll.dll,#1
  2⤵
  PID:2928