905e7a135834baf2f139e57b3ba4e59892684221d3132ff6463ad1902a0b11cd

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-06-2024 16:48

Target

QQ自动加群王V3.3 2014_破解版/iext.dll
Size

204KB
MD5

558f74091abc57e742291bdbad2380f9
SHA1

47f2884a4208adac9e561f9048433bcb3124910f
SHA256

f388f8fd2984df6c07c3efde836714ad32ba96be60b074442f178093c77e9190
SHA512

868b2c9406a4f3fe2272b15edf2d6aec11184d20b06d46b141c94faf9ea34f63c8da42c29fcd94bc41f06bdc13aa6bd200d6264f9ea84fb674d4699e29e26425
SSDEEP

3072:P3XRb5lLa357oof6s975EYWGXkEmWvW5KoUThKmg/NsMfULcsGKGg5k:PRb51a36ois75zKW7TasMsL7H

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 1280 wrote to memory of 2780	1280	rundll32.exe	28
PID 1280 wrote to memory of 2780	1280	rundll32.exe	28
PID 1280 wrote to memory of 2780	1280	rundll32.exe	28
PID 1280 wrote to memory of 2780	1280	rundll32.exe	28
PID 1280 wrote to memory of 2780	1280	rundll32.exe	28
PID 1280 wrote to memory of 2780	1280	rundll32.exe	28
PID 1280 wrote to memory of 2780	1280	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\QQ自动加群王V3.3 2014_破解版\iext.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\QQ自动加群王V3.3 2014_破解版\iext.dll",#1
  2⤵
  PID:2780

memory/2780-0-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download