43920a20626a75e1da4f04d7cfb399480555200543a1205615cd18e37ea188d1

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 14:14

Target

QQLive/ExceptCatch.dll
Size

93KB
MD5

4c5a7c55612f47ea7116dab10a2f6013
SHA1

efe7d6a13f1173d7022a1b68e5f7a306a719414f
SHA256

c4ec6348b345494097f3d84379a1916d0fa22c07943c238875e2d45e215935b1
SHA512

9c8767bd89625f47b17b662bf9baa7deb1902defca86aed5a6fa98c67590753bc8598424b9e7876cd7a10d86f5f533266634e6a8b8fc05b603fafe9f720f62fd
SSDEEP

1536:Hq0wPY0p2L1QwllwV122XfsXcvGlGJ9sreOX5OgaIJYfMXIRya7CYY:HqJPY0p2iwlCZsXgGisrDOgaIJTXkbS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2668	2304	rundll32.exe	31
PID 2304 wrote to memory of 2668	2304	rundll32.exe	31
PID 2304 wrote to memory of 2668	2304	rundll32.exe	31
PID 2304 wrote to memory of 2668	2304	rundll32.exe	31
PID 2304 wrote to memory of 2668	2304	rundll32.exe	31
PID 2304 wrote to memory of 2668	2304	rundll32.exe	31
PID 2304 wrote to memory of 2668	2304	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQLive\ExceptCatch.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQLive\ExceptCatch.dll,#1
  2⤵
  PID:2668