996e6000cebbcd231bb0ffb7c9dbe528c556d9e0081d38ecae0a6a10d432ce7d

Analysis

max time kernel
130s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 12:46

Target

$PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/rc.dll
Size

468KB
MD5

fd00f62dcb903fbbbe40aeb48a482708
SHA1

1333d5ef06dfd707e40a1322cb40c08487b3f50d
SHA256

3efdb3bf488038cf8c08b690f4bfa469fb49b9d2ed585ba3c88feb0770f37350
SHA512

c83ac2be93e05527e09de4ea0b3617bbcbb5747890c7a0b861ad3b55aaaec3d148783a7fcbbacb66b92ede37440d82d41fbfe8a871273f1c6796fdcbe63131a2
SSDEEP

3072:pekGhjtF5Zh0czWOWHxtXbDuFgHfrbVpFRcjuJIpJ4n26LTTaIxt0He7dcliVs1X:I+NfuFgHfrbVpFXJ8Ne7dVGbdonW6+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 560 wrote to memory of 1336	560	rundll32.exe	rundll32.exe
PID 560 wrote to memory of 1336	560	rundll32.exe	rundll32.exe
PID 560 wrote to memory of 1336	560	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PROGRAM_FILES\Baidu\Toolbar\BaiduBarX_Tmp\rc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:560

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PROGRAM_FILES\Baidu\Toolbar\BaiduBarX_Tmp\rc.dll,#1
2⤵
PID:1336