29e7cdc8660c96b05630f5a66fbbc9e9aca7fbf4f5cb1517a954e3dfd252511d

Analysis

max time kernel
139s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 07:07

Target

零时空/msvcm90.dll
Size

220KB
MD5

67bdb40fbe6cecc320507161b58d134a
SHA1

11ec8313ba20e96a0f776a018586cc127a451e16
SHA256

a15eaabbe6c32fba34c1cacd8c0f206c28a69a8b73e619c962d812ae7fa0f844
SHA512

687289c5740e5316abdaec56bbb6c0a629fc1f374b865a61f71ae3561738b42d3c31987e53ed0dbaed0aefd357824303b0dd7527baa81fee2434a4bcdec6433d
SSDEEP

3072:P5wveocziNzMLSMOYscmuW0AXLiLR4JpA86Goao1vJU87/amFYw8fF01OyAILH:hwyOMqcp3AXOLR4JpL6ft3/amiX2OyX

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 2688	1784	rundll32.exe	84
PID 1784 wrote to memory of 2688	1784	rundll32.exe	84
PID 1784 wrote to memory of 2688	1784	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\零时空\msvcm90.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\零时空\msvcm90.dll,#1
  2⤵
  PID:2688