1c388a8bd8a2f14fb270c3bcd6ef475f7536f1dd6412f0e91746c054d15db58d

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 21:55

Target

Ծע/eAPI.dll
Size

320KB
MD5

8a8dfdd6ef9f17e5caba3d2fd9995805
SHA1

8eb39efd8e1cd127ec0a32ae6118704c87367e97
SHA256

6ec377e848c7254cc22b1a8e5eb1599bc31805b1fcfda1a2cc5999f6b28ea839
SHA512

3998832d2732d82e3559395029cd8bbde70d090def133e96b401d409bae2c2477fac229a12a04e795e4ea0ee0de11688ff6dea65c3372b0f90e43cb170291946
SSDEEP

3072:rU0swaxu1SrlTvpSuKsZZA+CaHgepAPAdh+SmTsc05nJhonAfVMQDjwQ+9JsOyOK:rUHwakEr9p+AbCQpAIdh6mVMewQ+LIa

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1124	1492	rundll32.exe	27
PID 1492 wrote to memory of 1124	1492	rundll32.exe	27
PID 1492 wrote to memory of 1124	1492	rundll32.exe	27
PID 1492 wrote to memory of 1124	1492	rundll32.exe	27
PID 1492 wrote to memory of 1124	1492	rundll32.exe	27
PID 1492 wrote to memory of 1124	1492	rundll32.exe	27
PID 1492 wrote to memory of 1124	1492	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Ծע\eAPI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Ծע\eAPI.dll,#1
  2⤵
  PID:1124

memory/1124-55-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download