29e7cdc8660c96b05630f5a66fbbc9e9aca7fbf4f5cb1517a954e3dfd252511d

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 07:07

Target

零时空/hotfixui.dll
Size

415KB
MD5

ada9053ca6b702baaeb0ad417dda01c0
SHA1

34aa4c2825f814d9efbac8a4344e4d2618bf17bb
SHA256

700c408881f08f1c6bf04873d6db50f76d016a29083b3e0bc3e399a93325dfc7
SHA512

c528c0356525c41aeee02eba642800bb5749b2bc9f345b82887e0f8c14917216184102b43c6116cc8bbca34837930a247092c4ff662134c0e372d16048ac252f
SSDEEP

6144:2Rr5G41Ls7/LuG+StDE4scFYK+3/FEs8OzHNkTBf83Ivj/35wuOtVh:2l5v1Lu/LjtA5cFEEs8OztkT583IFw

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 2468	2456	rundll32.exe	30
PID 2456 wrote to memory of 2468	2456	rundll32.exe	30
PID 2456 wrote to memory of 2468	2456	rundll32.exe	30
PID 2456 wrote to memory of 2468	2456	rundll32.exe	30
PID 2456 wrote to memory of 2468	2456	rundll32.exe	30
PID 2456 wrote to memory of 2468	2456	rundll32.exe	30
PID 2456 wrote to memory of 2468	2456	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\零时空\hotfixui.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\零时空\hotfixui.dll,#1
  2⤵
  PID:2468