eec3a450c88d7aceb20da1ff81630484c81c5ffc025429803f61bcb1ca45a25f

Resubmissions

31/05/2024, 21:40

31/05/2024, 18:30

31/05/2024, 18:28

31/05/2024, 18:26

max time kernel
123s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
31/05/2024, 21:40

Target

骑士精神2- 整个文件夹解压桌面打开/307.dll
Size

45.5MB
MD5

17a351a5d2fcdf9beae46bf17b8fd696
SHA1

9ddb2fb630a87d00227170e1e6bbc534f8260df6
SHA256

aefd0df2f84aabd659a363fa66910d683263d3faeb4e5cd58f63363dd1662de0
SHA512

6adbd992bbf7284faf285445d55e61709e9f9e9939dd86ac78dad4d941bdf6f1702150bc7111a5f7637c9ecd9179bc883d4d2e9a7674710d4bae24e5f4cf157a
SSDEEP

786432:BoMdRenWHSRTPyxn2JYH1LBpqCJvnPnljhVeWdaKN+mqpq+vyJmVq4:BoMdRenAwPy4WVFpLJvnvlNV1dzZ+vye

Score

8^/10

Blocklisted process makes network request 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 4856	5032	rundll32.exe	81
PID 5032 wrote to memory of 4856	5032	rundll32.exe	81
PID 5032 wrote to memory of 4856	5032	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\骑士精神2- 整个文件夹解压桌面打开\307.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\骑士精神2- 整个文件夹解压桌面打开\307.dll",#1
  2⤵
  - Blocklisted process makes network request
  PID:4856

memory/4856-0-0x0000000010000000-0x0000000013CD2000-memory.dmp

Filesize
60.8MB

Download
memory/4856-1-0x0000000003E20000-0x0000000003E8B000-memory.dmp

Filesize
428KB

Download
memory/4856-7-0x0000000003EA0000-0x0000000003EA1000-memory.dmp

Filesize
4KB

Download
memory/4856-6-0x0000000003E90000-0x0000000003E91000-memory.dmp

Filesize
4KB

Download
memory/4856-5-0x0000000077A14000-0x0000000077A15000-memory.dmp

Filesize
4KB

Download
memory/4856-8-0x0000000003EB0000-0x0000000003EB1000-memory.dmp

Filesize
4KB

Download
memory/4856-9-0x0000000010000000-0x0000000013CD2000-memory.dmp

Filesize
60.8MB

Download