最近大范围报警如下,很紧急:
MA_Remote_Process_Injection - Regsvr32/Rundll32
c:\\windows\\system32\\rundll32.exe \"C:\\WINDOWS\\sysnative\\rundll32.exe\" \"C:\\Users\\min.zhang\\AppData\\Roaming\\Reader\\AiWorkShell64.dll\" RunCmd placeholder --cmd=inject --pid=17544 --tid=8180
进程的命令行中有明显的注入尝试迹象。请说明一下情况,谢谢
Process Command Line c:\\windows\\system32\\rundll32.exe \"C:\\WINDOWS\\sysnative\\rundll32.exe\" \"C:\\Users\\min.zhang\\AppData\\Roaming\\Reader\\AiWorkShell64.dll\" RunCmd placeholder --cmd=inject --pid=17544 --tid=8180
The following arguments suggest that code injection attempts are being performed by this tool using Rundll32.exe:
• RunCmd is an exported function being called from the DLL "AiWorkShell64.dll".
• "--cmd=inject" suggests code injection
• "--pid=17544 and --tid=8180" refer to the Process ID and Thread ID of the target process and thread for injection.
|
|
|
|
|
|
评论
直达楼层