0670a1be17f76a663c39141d1e8dbc27800461e1dcdaefaf0d5d7466fec01943

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 19:46

Target

金致QQ附近人营销神器(向QQ附近人发消息)_Jisuxz.com/UUWiseHelper.dll
Size

318KB
MD5

bbc6da86a5fa92e1314fe03187265f3e
SHA1

03063aaa92309dac583bf4a1002b61c7357ec075
SHA256

ae32e5e777c7f9261de976a00fe43fff610cb473a61fcf8369669de58a354d22
SHA512

385ddf3f97b6446bc40e0057dc604e16b023de3e34b28e1f8681bbcbc56e3da82d033c7633b54bd011339fffc32c53e1fc039e37eefe8376f9d8f7dd1de8377e
SSDEEP

6144:u5cCQ3KrGsslg017+HWL8/DeZ7/ODmLjE/:CJr7sv7+Hl/CZCivE

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2256	2548	rundll32.exe	28
PID 2548 wrote to memory of 2256	2548	rundll32.exe	28
PID 2548 wrote to memory of 2256	2548	rundll32.exe	28
PID 2548 wrote to memory of 2256	2548	rundll32.exe	28
PID 2548 wrote to memory of 2256	2548	rundll32.exe	28
PID 2548 wrote to memory of 2256	2548	rundll32.exe	28
PID 2548 wrote to memory of 2256	2548	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\金致QQ附近人营销神器(向QQ附近人发消息)_Jisuxz.com\UUWiseHelper.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\金致QQ附近人营销神器(向QQ附近人发消息)_Jisuxz.com\UUWiseHelper.dll,#1
  2⤵
  PID:2256