08ccc4452d1dee6da9362d6e0a91a0ee02842a1bddb679d2cb3c267cb8a4860f

Analysis

max time kernel
27s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 09:07

Target

928免杀远控/iext2.dll
Size

492KB
MD5

dba5fdbe7ec94463b3f6fdf2162c9f95
SHA1

a97137b4f2b77166b2a23da1f58e0bdb7365f4f2
SHA256

a8b14f31098a191631696db5ddc77e029b48999542e0ec15b63df02220c66d37
SHA512

325439bb5fe0e18e08cd547e9e9d505aa5b1ee51a436cb155254cfb04d318679e7a016cc2e72ffaba49bed20e15e85b26fd2a22e726e211650317218dde53ba6
SSDEEP

6144:0ujp9xZF+ES6jisyHOzC8QxEksWINE1DfYmgykSjsUgZ43KyEBuXwKF:VZFX5zC8XkBIm1DfYml7otm3YBu

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2024 wrote to memory of 2036	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 2036	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 2036	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 2036	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 2036	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 2036	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 2036	2024	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\928免杀远控\iext2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\928免杀远控\iext2.dll,#1
  2⤵
  PID:2036

memory/2036-54-0x0000000000000000-mapping.dmp

Download
memory/2036-55-0x0000000075511000-0x0000000075513000-memory.dmp

Filesize
8KB

Download