80a1fd1ece493f72a864f3e60d1ea43e503b27a11a9d18234ec398337c574aaa

Analysis

max time kernel
12s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 05:47

Target

QQռ˵˵ɾ/iext.dll
Size

216KB
MD5

0eb35ab5936d0ade7eb3e6ebdefc78e5
SHA1

a0f369f09f4ebeef78fce0efeb10ac24b1c3aa27
SHA256

5035b54ba210173e82004291090b59c0630d17c45eadb48e9744f94303a2b891
SHA512

1d51e36a847a1b2a6ea0cc8e1b988386401c2b033344b5571fecb83a8da62848f61176a13fbd13c976aded4f915daa8fc7517fd5b08e6a35e4d0c53d05317176
SSDEEP

3072:hfHFz60KNUP7j4f/FW3gMTnkCnnvZsfwoKUjJRjqH9Z/oUHhXMG5Ra7l:hfHYbS4VJMTntnvZsIijJpqndXMG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1416	2032	rundll32.exe	28
PID 2032 wrote to memory of 1416	2032	rundll32.exe	28
PID 2032 wrote to memory of 1416	2032	rundll32.exe	28
PID 2032 wrote to memory of 1416	2032	rundll32.exe	28
PID 2032 wrote to memory of 1416	2032	rundll32.exe	28
PID 2032 wrote to memory of 1416	2032	rundll32.exe	28
PID 2032 wrote to memory of 1416	2032	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQռ˵˵ɾ\iext.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQռ˵˵ɾ\iext.dll,#1
  2⤵
  PID:1416

memory/1416-55-0x00000000767B1000-0x00000000767B3000-memory.dmp

Filesize
8KB

Download