80a1fd1ece493f72a864f3e60d1ea43e503b27a11a9d18234ec398337c574aaa

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 05:47

Target

QQռ˵˵ɾ/EThread.dll
Size

60KB
MD5

41ff14216ad567a3855d9c18d0f72a5b
SHA1

02fcc48754fa98e38010ae7b978d53f6376f9d56
SHA256

3709c96ce81d57ca7a5ffc3c4d830aa3f224b02b84446058520c5d45ccd845cc
SHA512

bd7bb2db0153898d002458ec6a177c75e45f2d21c7134a07bb25de66b00a23d61e92e0fdad312f414960b9a5180e7b157e304c750ab5e182d25285f4b79e6ffe
SSDEEP

768:9NOcug/0M1vru9jVm/hrLdafM77Ofqr5BeT8+wVoh9xJT6Fq4oq+H8c7e:j5/bvrGIJrxf7rOolqh9xQboNcc7

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 792 wrote to memory of 1520	792	rundll32.exe	28
PID 792 wrote to memory of 1520	792	rundll32.exe	28
PID 792 wrote to memory of 1520	792	rundll32.exe	28
PID 792 wrote to memory of 1520	792	rundll32.exe	28
PID 792 wrote to memory of 1520	792	rundll32.exe	28
PID 792 wrote to memory of 1520	792	rundll32.exe	28
PID 792 wrote to memory of 1520	792	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQռ˵˵ɾ\EThread.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQռ˵˵ɾ\EThread.dll,#1
  2⤵
  PID:1520

memory/1520-55-0x00000000763D1000-0x00000000763D3000-memory.dmp

Filesize
8KB

Download