43920a20626a75e1da4f04d7cfb399480555200543a1205615cd18e37ea188d1

Analysis

max time kernel
15s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 14:14

Target

QQLive/Encrypt.dll
Size

14KB
MD5

1bf231fd332bd4bb456491ca2a369163
SHA1

238b9dc784000478feff017e85ca9d330ee6fa77
SHA256

ecb41f5a7c6ed3a429c9b81ddb78921040009062d6d555556d46f7e951cd0326
SHA512

cd56791b5ec7207b518d33be026417f611774a693314c1179599f80926a2c388bb3a7e65378175545875b49280f1056d21f741a42e9415d729bca2ceda227262
SSDEEP

192:4lkOCL9DohXVW3a08cQ2ccIcyLMQ03X7H6CkqhIMyowJL/8Qpkqs1Iu55+ebCfNe:8CL9DmVW33yFTMdrH67MYJLu1vPbCzdG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 2076	2840	rundll32.exe	29
PID 2840 wrote to memory of 2076	2840	rundll32.exe	29
PID 2840 wrote to memory of 2076	2840	rundll32.exe	29
PID 2840 wrote to memory of 2076	2840	rundll32.exe	29
PID 2840 wrote to memory of 2076	2840	rundll32.exe	29
PID 2840 wrote to memory of 2076	2840	rundll32.exe	29
PID 2840 wrote to memory of 2076	2840	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQLive\Encrypt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQLive\Encrypt.dll,#1
  2⤵
  PID:2076