80a1fd1ece493f72a864f3e60d1ea43e503b27a11a9d18234ec398337c574aaa

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 05:47

Target

QQռ˵˵ɾ/eAPI.dll
Size

320KB
MD5

ae4a6846b6864648fe6f080acec0372b
SHA1

084f461392d7c2b35999b7a0b18c8637801822f2
SHA256

f7ccae2a83ae48e3a4d84a77482258b19bae3043b28fbb3cfc02ca93692c4eca
SHA512

7169e30a16444e13af8aae26e18a654747885c9913c1073b0686994c684ce46539f7204665c480933602b5b5941a768706ca69d5e6fe0e758b10faa878e473db
SSDEEP

6144:/hP8pv4q6LwUaZHfBEObei7fGuuESrhvpK1SNqrJdA4WVIzaLX3fv0DYV:4zUaHJZKrhvpK1S8Mv2OuY

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 4924	4880	rundll32.exe	80
PID 4880 wrote to memory of 4924	4880	rundll32.exe	80
PID 4880 wrote to memory of 4924	4880	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQռ˵˵ɾ\eAPI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQռ˵˵ɾ\eAPI.dll,#1
  2⤵
  PID:4924