d7d47aa5796cad499374b284e865f715e7496efca16566add1c3a505730259de

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
03-07-2024 06:48

Target

$APPDATA/KuaiKuai/KKGame/download/libexpatw.dll
Size

148KB
MD5

226e01d42edd35c3c87bc7084b61bc10
SHA1

c640234a4988edc5ce2fc7263b27788b9ed79073
SHA256

fc580ba332907a472f8f89a4bd97d05d8fa9103aca535918f62093a230013bad
SHA512

1bbebf740619b9b8d0e2a50109717a679318bfb1cf7e8cfee1067262ed5034e13f45a49d1b83e16a85ff21ca67804209fc7999bf9d923150f478cf2cfadeadd6
SSDEEP

3072:WfDGNmrTuXsTbSm00w+oqQA3xEz5/2t+dCQ7q:WfDZW8TbD00wec5z5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 796	1900	rundll32.exe	28
PID 1900 wrote to memory of 796	1900	rundll32.exe	28
PID 1900 wrote to memory of 796	1900	rundll32.exe	28
PID 1900 wrote to memory of 796	1900	rundll32.exe	28
PID 1900 wrote to memory of 796	1900	rundll32.exe	28
PID 1900 wrote to memory of 796	1900	rundll32.exe	28
PID 1900 wrote to memory of 796	1900	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\KuaiKuai\KKGame\download\libexpatw.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\KuaiKuai\KKGame\download\libexpatw.dll,#1
  2⤵
  PID:796