531313033fdb71c44c0791f56679e55c36f06fa6250f90f68ebaf42e7a2a044b

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
20-07-2024 06:29

Target

$_15_/Baidu/Baidu/plugin/extends/game/1.0.0.3/JoystickService.dll
Size

172KB
MD5

e658ff0dcf3df710575c08148fe8b476
SHA1

e22a478cecb80d00e74b9f6224cfb7329aa89c1d
SHA256

1e8676f20da79fbb0fef694be17ede1047d0d68e9c7d07b1dac4e7bec3c7ffbc
SHA512

37f36be43d1393f0fc686e13fb56bf1412e2e7c637a74b7274a9adfc44a342bf5c5745750628dd4cecc20ed0a79342bda22ae2d6b58c245da1f1dc12bc6390c0
SSDEEP

3072:3xFZpErmhoqx+16K8FCH/cpuMF6/G4JKmqDiyOoCJWNOfiuUyqtziX:3xzpErmhoqkzU36/G4IYysANOfFUpiX

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 3064	2152	rundll32.exe	30
PID 2152 wrote to memory of 3064	2152	rundll32.exe	30
PID 2152 wrote to memory of 3064	2152	rundll32.exe	30
PID 2152 wrote to memory of 3064	2152	rundll32.exe	30
PID 2152 wrote to memory of 3064	2152	rundll32.exe	30
PID 2152 wrote to memory of 3064	2152	rundll32.exe	30
PID 2152 wrote to memory of 3064	2152	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_15_\Baidu\Baidu\plugin\extends\game\1.0.0.3\JoystickService.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_15_\Baidu\Baidu\plugin\extends\game\1.0.0.3\JoystickService.dll,#1
  2⤵
  PID:3064