232b88f022b29606ea71562be8c6d7efec87137357ed1a35fa1a05c8086dab4c

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 18:01

Target

44017993/第2章智能安防报警系统/WinIo.dll
Size

48KB
MD5

6d113aa35a8c79b236751e4ccf2b7751
SHA1

b4ac97768512acd31e4a824b6595ec2163db7972
SHA256

d2eb2a40174b9adb3abc768af7fa80882cd1e2ad22303fe4448db89509ac392b
SHA512

f83209d9e98395ae6127f247b7f68167708c1af789a332695feed0f7879d8a83405eed3c3e860e482cebc704a613563bcadfaa8a2986e348d85e50a2e0b3fb68
SSDEEP

384:XPgsb8J2hTBC6nE5Ig7p+lAK37l6ape8cMAp3XynYHlwouJC6+p8oyx8rd:XPLhTBC6E5gAK3p618sXhHlwodL8oyW

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 2000	1252	rundll32.exe	28
PID 1252 wrote to memory of 2000	1252	rundll32.exe	28
PID 1252 wrote to memory of 2000	1252	rundll32.exe	28
PID 1252 wrote to memory of 2000	1252	rundll32.exe	28
PID 1252 wrote to memory of 2000	1252	rundll32.exe	28
PID 1252 wrote to memory of 2000	1252	rundll32.exe	28
PID 1252 wrote to memory of 2000	1252	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\44017993\第2章智能安防报警系统\WinIo.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\44017993\第2章智能安防报警系统\WinIo.dll",#1
  2⤵
  PID:2000