08ccc4452d1dee6da9362d6e0a91a0ee02842a1bddb679d2cb3c267cb8a4860f

Analysis

max time kernel
183s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 09:07

Target

928免杀远控/eAPI.dll
Size

320KB
MD5

8a8dfdd6ef9f17e5caba3d2fd9995805
SHA1

8eb39efd8e1cd127ec0a32ae6118704c87367e97
SHA256

6ec377e848c7254cc22b1a8e5eb1599bc31805b1fcfda1a2cc5999f6b28ea839
SHA512

3998832d2732d82e3559395029cd8bbde70d090def133e96b401d409bae2c2477fac229a12a04e795e4ea0ee0de11688ff6dea65c3372b0f90e43cb170291946
SSDEEP

3072:rU0swaxu1SrlTvpSuKsZZA+CaHgepAPAdh+SmTsc05nJhonAfVMQDjwQ+9JsOyOK:rUHwakEr9p+AbCQpAIdh6mVMewQ+LIa

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 808 wrote to memory of 5068	808	rundll32.exe	rundll32.exe
PID 808 wrote to memory of 5068	808	rundll32.exe	rundll32.exe
PID 808 wrote to memory of 5068	808	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\928免杀远控\eAPI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\928免杀远控\eAPI.dll,#1
  2⤵
  PID:5068