f6de40a0e0c5b51daa70456189d10f7fc1e7dcd36168cf8afcb17035efda6686

Analysis

max time kernel
128s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2024, 10:26

Target

$PLUGINSDIR/WeChatInstallDll.dll
Size

3.6MB
MD5

2acb0c1f4f388e1dd5be9a01c9593185
SHA1

4700a4c989ef847f0bf39c907d08968003ec5942
SHA256

749fb2d7f65cfad8928a842d1103c22dab3239296472947798504b15858422ba
SHA512

fcba0b51326ead208db123c17118c452082fdcff9379328c5b4c0825d4039de80932cab8c38a2b7f95955907ce1a92bba4021e7e48bab7988991088cf7189f7b
SSDEEP

49152:OGHSauEm8jA+ZojaXvP3WW43XOYlZiz2yNyc0yfgWFbxq/WPyZuTJGeXMK+u80e8:OGHSabb7ZB/P2l+0yfgO0/FZPeV+d03

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 928	3692	rundll32.exe	90
PID 3692 wrote to memory of 928	3692	rundll32.exe	90
PID 3692 wrote to memory of 928	3692	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WeChatInstallDll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WeChatInstallDll.dll,#1
  2⤵
  PID:928