bf176a4b8c3cec298fe69a631aca88f9ebf3a9757d53d9ca49e1ad0bf2d8a0e9

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 04:54

Target

急速辅助免费版1223/前锋加速器1.6/eAPI.dll
Size

320KB
MD5

1a5f68d23de66cfc1ff110088fb8d170
SHA1

38d4fbb2c499d4a09e99bbf9cc3aa199055dd46c
SHA256

ec11e9b9d75d382300578a88512033710e6bcbb3f740e293fbcea3ef129e7a45
SHA512

9cc77ee8d09d72ccfc6fe3ae8417ae013e8a0312332d63b86e62eb794d1579c1f82aab161eaac8cc0ac1270d1f295ab90f021381c2e0d8f1bb3efcb10d6e2504
SSDEEP

6144:p/OZQ+MJfmMQFVgqGhA4WVGIlWJZmmaKkdEXaLIuPqIEY/7UEneK88KjjonXekmI:1OZQnQ1FVgFWvwXXaLIuSIEY/7UEneKT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1652 wrote to memory of 1340	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1340	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1340	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1340	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1340	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1340	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1340	1652	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\急速辅助免费版1223\前锋加速器1.6\eAPI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\急速辅助免费版1223\前锋加速器1.6\eAPI.dll,#1
  2⤵
  PID:1340

memory/1340-54-0x0000000000000000-mapping.dmp

Download
memory/1340-55-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download