Analysis

  • max time kernel
    147s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-11-2022 05:16

General

  • Target

    急速辅助免费版1120/前锋加速器/eAPI.dll

  • Size

    320KB

  • MD5

    75e3942b26c39888cc2ee9b732a101c8

  • SHA1

    31fafc5d186101da0a546ff044765e5e22efadbd

  • SHA256

    dc48317159bbdb48ce79932411561c2be9efc3ce952dfd698609bd4033256f05

  • SHA512

    c664365c20fc2da3117f142f819961a7db29c3bc4a453fefdfc534e34a4c1012794c58915183822e7ff7f05c604c321c5ce1631c1fc9a97c37ebc5b4322bf040

  • SSDEEP

    6144:yVv24BZWu21ov/di3CqinRzQA4WVEuwQ+jNb:yVvHop8SCqgrvvwQ8

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\急速辅助免费版1120\前锋加速器\eAPI.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4316
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\急速辅助免费版1120\前锋加速器\eAPI.dll,#1
      2⤵
        PID:4612

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4612-132-0x0000000000000000-mapping.dmp