7a2a33d544a3f1d91ce2fe7c6b7437a639c8fea39610c2abb822cbcdc929d394

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 04:05

Target

Program Files (x86)/WanNengInput/WnPYSkinPreview.dll
Size

1.7MB
MD5

28e6f0d051c2cec022bd263d84c52507
SHA1

13133b0c0d186d8cdfbdaf16d2427f39bdaec537
SHA256

8980c207b424e03f862b5709de0aba5a66bdbb10556f35416582714a48d18f45
SHA512

e52cf62e3ac93b69a8bbae9d47eb296940e0ff12b812133ca9aa33632133e52e6b1bba03ee3e2194208f04894c7cef71b1e3cf86d4fae8932002c783020cbd2c
SSDEEP

49152:3Xf8zy/7bejy8BEzPacoI1EDcyTFmlWzh2d:3Eq7KjyL4I1E6X

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 1160	1460	rundll32.exe	30
PID 1460 wrote to memory of 1160	1460	rundll32.exe	30
PID 1460 wrote to memory of 1160	1460	rundll32.exe	30
PID 1460 wrote to memory of 1160	1460	rundll32.exe	30
PID 1460 wrote to memory of 1160	1460	rundll32.exe	30
PID 1460 wrote to memory of 1160	1460	rundll32.exe	30
PID 1460 wrote to memory of 1160	1460	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Program Files (x86)\WanNengInput\WnPYSkinPreview.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Program Files (x86)\WanNengInput\WnPYSkinPreview.dll",#1
  2⤵
  PID:1160