d52138cdf8524c5fcaef9770eaf300b4e820e8d002869789bd056b16afbc9da9

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 01:33

Target

乐刷助手(淘宝小号管理，拍单助手) 2.1.9/krnln.dll
Size

1.0MB
MD5

44e2ca67c060fbe3dc0d030149f5a478
SHA1

5df61eb626bc3849893701942114609c1086d496
SHA256

6ced19283dbbb95f264448f380592f4e98ba8228efca2f68821ab3ae61029d93
SHA512

1a348c7585d78dd68c1d0e059ea1d7cea57c1aeff734f834f75025719b9fdd0e9bb16aebe75e15502a1b83106387eaa9493b8990999e0a68b62c1afdbc8cf45e
SSDEEP

12288:rb0+sqCE6yy4bmhSd+1YCHYFZzktq0TNSARuOrRUVbNGvNXXYA/2b:AjE6+bhiHYF5kZI6uOrRUjYNXXYA/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3504 wrote to memory of 1300	3504	rundll32.exe	83
PID 3504 wrote to memory of 1300	3504	rundll32.exe	83
PID 3504 wrote to memory of 1300	3504	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\乐刷助手(淘宝小号管理，拍单助手) 2.1.9\krnln.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\乐刷助手(淘宝小号管理，拍单助手) 2.1.9\krnln.dll",#1
  2⤵
  PID:1300