16e82bd509cf326cc7b3239459f80196bdde1fb15cad21e03e48189e4e73f857

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-04-2024 16:08

Target

taobao_qunfa_5.70/iext2.dll
Size

460KB
MD5

bd105196d705592175df247327550266
SHA1

fd9792c08f42da3a9e6efd007734817e45a5870f
SHA256

f11aa27688b9ad11aefe63c14447d1d4abbb4ca720a9f9006207ed650219387c
SHA512

6e026abb57dfbc407b6a32534bc0c50c50a009232ec2dfb4a9ff385d90392ff85b57730dcd2a7cc25db75ab2771d34eb60e06d179b73967570e944871bbb076e
SSDEEP

12288:4jduClb4j7r5vYB8s6SoJVqxz4FzhmnfWIlymAfm3ZuhP:4j/lb4j7r5vYBX6SoJVqxz4FzhmnfWIT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1996 wrote to memory of 2120	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 2120	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 2120	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 2120	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 2120	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 2120	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 2120	1996	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\taobao_qunfa_5.70\iext2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1996

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\taobao_qunfa_5.70\iext2.dll,#1
2⤵
PID:2120