49c6d44dbb82d1f3760736f2eac2c10fad305d1518492a3f2837526f0c1a17b4

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 22:19

Target

软件印章大师8.0 破解版/Comdata.dll
Size

1.4MB
MD5

695da67535f17dffbfa38f7a1b2dceff
SHA1

65b57f0dd2a406e448a661435ca53f487f745dc0
SHA256

dec886d61ee4232cfa6c5b10701c73705dde0ba939d3065fef26c3fd3cfc3aa2
SHA512

b51745b76bf47f5158b50ffbca784eb19627712cf809235e7617d3c21b9dd43eb879c293a4634e6711597f36124ef72991b9cba214a601cf787f897b36576660
SSDEEP

24576:YIEeCfDuXy5W6KR+aitD4dchwgot3sRR3EJY8oexUkklwn0C:km2+bcDochwgusfOY8oeCkkq

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3220 wrote to memory of 4672	3220	rundll32.exe	83
PID 3220 wrote to memory of 4672	3220	rundll32.exe	83
PID 3220 wrote to memory of 4672	3220	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\软件印章大师8.0 破解版\Comdata.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\软件印章大师8.0 破解版\Comdata.dll",#1
  2⤵
  PID:4672

memory/4672-0-0x0000000002970000-0x0000000002AE1000-memory.dmp

Filesize
1.4MB

Download
memory/4672-1-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

Filesize
4KB

Download
memory/4672-2-0x0000000002970000-0x0000000002AE1000-memory.dmp

Filesize
1.4MB

Download