7882eab29859c18474d3674f7802e17c2c78616f3dc9c5afbba04bd30db1b213

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 19:03

Target

CAD迷你画图/mfc100u.dll
Size

4.2MB
MD5

f841f32ad816dbf130f10d86fab99b1a
SHA1

0f8b90814b33275cf39f95e769927497da9460bf
SHA256

7a4cfbce1eb48d4f8988212c2e338d7781b9894ef0f525e871c22bb730a74f3e
SHA512

6222f16722a61ee6950b6fbcbe46c2b08e2394ce3dd32d34656faf2719e190e66b4e59617c83f117ad3793b1292a107f275087b037cf1b6e4d9819323748079a
SSDEEP

98304:zge9f+eJ5LbHVlaHqQ1NaXJw9QxCqk23i3ggGe9SfcoLDPiHkKos7FLOAkGkzdnR:zxf5cBudLps7FLOyomFHKnPAw

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 1704 wrote to memory of 1944	1704	rundll32.exe	28
PID 1704 wrote to memory of 1944	1704	rundll32.exe	28
PID 1704 wrote to memory of 1944	1704	rundll32.exe	28
PID 1704 wrote to memory of 1944	1704	rundll32.exe	28
PID 1704 wrote to memory of 1944	1704	rundll32.exe	28
PID 1704 wrote to memory of 1944	1704	rundll32.exe	28
PID 1704 wrote to memory of 1944	1704	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CAD迷你画图\mfc100u.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CAD迷你画图\mfc100u.dll,#1
  2⤵
  PID:1944