16e82bd509cf326cc7b3239459f80196bdde1fb15cad21e03e48189e4e73f857

Analysis

max time kernel
114s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21-04-2024 16:08

Target

taobao_qunfa_5.70/HtmlView.dll
Size

212KB
MD5

4c9e8f81bf741a61915d0d4fc49d595e
SHA1

d033008b3a0e5d3fc8876e0423ee5509ecb3897c
SHA256

951d725f4a12cd4ff713ca147fa3be08a02367db6731283c3f1ba30445990129
SHA512

cf2c6f8f471c8a5aad563bc257035515860689b73ce343599c7713de8bc8338a031a722f366e005bc1907d6fc97b68b8b415e8ff05b7324fb1040c5dc02315d7
SSDEEP

3072:oQuAhdg7cWLmDYvGdVEJy7vsdbIzL66ou+jcmNrW65uxIoPNH3yjedlj:27ODYvmEc7PV7JE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3028 wrote to memory of 4372	3028	rundll32.exe	rundll32.exe
PID 3028 wrote to memory of 4372	3028	rundll32.exe	rundll32.exe
PID 3028 wrote to memory of 4372	3028	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\taobao_qunfa_5.70\HtmlView.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3028

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\taobao_qunfa_5.70\HtmlView.dll,#1
2⤵
PID:4372