6f7b6fcc5e39784aeb658cb8bbe2b2366657bb8aa4940aaf0e843d00ce8c4575

Analysis

max time kernel
134s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 13:34

Target

tw6805a驱动/P2PClient/client.dll
Size

1.2MB
MD5

f1e0d2f113c779d5bc1794f17bb7a08a
SHA1

374089897e9f1a538d515abb93ac25f520825fc1
SHA256

d9e9e7fc7e5a8978b813af7289f21a331d325141aa93c93fa2157bae77e66428
SHA512

21558c6512addc0c0f1a5a36a349f2f21924f3788b50b3ca1be56b5d971d09993215773ce7a2a22cb99f08a1e7b706fb82bab6415c2f7ca9566cf6976d61e742
SSDEEP

24576:yVRRbmvOwCFH9rB06gJGXU6Nby4QuLN+Hq1OZZGM5mrPaIO+5Q+u:O+O3T0bKnNbSuL4ePary

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2428	2340	rundll32.exe	83
PID 2340 wrote to memory of 2428	2340	rundll32.exe	83
PID 2340 wrote to memory of 2428	2340	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\tw6805a驱动\P2PClient\client.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\tw6805a驱动\P2PClient\client.dll,#1
  2⤵
  PID:2428