a61f88ce7a97b6c24fd4ea28bf7a8e752d33d19499323541c4d435a856d77921

Analysis

max time kernel
136s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 07:41

Target

ZTE_U880_V3升级工具/DownLoadDLL.dll
Size

60KB
MD5

41429833abea5fd05899ffca5aeb046b
SHA1

d1f2d2deca545416fdf0ae49b63f4d5987fe2266
SHA256

a275906027127af43705f81b0c03df2e990ada77ef8b4f24b1ff9fe6e69cb261
SHA512

745c84ced6dcd16395fab03402fdf60e862050aa4e220ea28c7b547cf5fdf12824f58aee2f7ac46aff29be3869cdab3fbbbc50b3c9b7d115644262a08f2b5c22
SSDEEP

768:H3VvOyK3P5c26rmzu2c9tZofG9CORD0HT3708KJRL1vZIXdp:XVvI3P0mDctofupAz1KDQT

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 3540	3632	rundll32.exe	82
PID 3632 wrote to memory of 3540	3632	rundll32.exe	82
PID 3632 wrote to memory of 3540	3632	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZTE_U880_V3升级工具\DownLoadDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZTE_U880_V3升级工具\DownLoadDLL.dll,#1
  2⤵
  PID:3540