d52138cdf8524c5fcaef9770eaf300b4e820e8d002869789bd056b16afbc9da9

Analysis

max time kernel
129s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 01:33

Target

乐刷助手(淘宝小号管理，拍单助手) 2.1.9/iext2.dll
Size

492KB
MD5

dba5fdbe7ec94463b3f6fdf2162c9f95
SHA1

a97137b4f2b77166b2a23da1f58e0bdb7365f4f2
SHA256

a8b14f31098a191631696db5ddc77e029b48999542e0ec15b63df02220c66d37
SHA512

325439bb5fe0e18e08cd547e9e9d505aa5b1ee51a436cb155254cfb04d318679e7a016cc2e72ffaba49bed20e15e85b26fd2a22e726e211650317218dde53ba6
SSDEEP

6144:0ujp9xZF+ES6jisyHOzC8QxEksWINE1DfYmgykSjsUgZ43KyEBuXwKF:VZFX5zC8XkBIm1DfYml7otm3YBu

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2860	2432	rundll32.exe	82
PID 2432 wrote to memory of 2860	2432	rundll32.exe	82
PID 2432 wrote to memory of 2860	2432	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\乐刷助手(淘宝小号管理，拍单助手) 2.1.9\iext2.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\乐刷助手(淘宝小号管理，拍单助手) 2.1.9\iext2.dll",#1
  2⤵
  PID:2860