16e82bd509cf326cc7b3239459f80196bdde1fb15cad21e03e48189e4e73f857

Analysis

max time kernel
141s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21-04-2024 16:08

Target

taobao_qunfa_5.70/krnln.dll
Size

1.1MB
MD5

638e737b2293cf7b1f14c0b4fb1f3289
SHA1

f8e2223348433b992a8c42c4a7a9fb4b5c1158bc
SHA256

baad4798c3ab24dec8f0ac3cde48e2fee2e2dffa60d2b2497cd295cd6319fd5b
SHA512

4d714a0980238c49af10376ff26ec9e6415e7057925b32ec1c24780c3671047ac5b5670e46c1c6cf9f160519be8f37e1e57f05c30c6c4bda3b275b143aa0bf12
SSDEEP

12288:gRZTEr9vWWBjekIPNSohrqbTkjd67pStJgkyOPNMfvsnIPb1m:vJvWmeP5rqnkwpiJxyOPNMnrb1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4784 wrote to memory of 3364	4784	rundll32.exe	rundll32.exe
PID 4784 wrote to memory of 3364	4784	rundll32.exe	rundll32.exe
PID 4784 wrote to memory of 3364	4784	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\taobao_qunfa_5.70\krnln.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4784

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\taobao_qunfa_5.70\krnln.dll,#1
2⤵
PID:3364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4164 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:2084