80a1fd1ece493f72a864f3e60d1ea43e503b27a11a9d18234ec398337c574aaa

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 05:47

Target

QQռ˵˵ɾ/iext.dll
Size

216KB
MD5

0eb35ab5936d0ade7eb3e6ebdefc78e5
SHA1

a0f369f09f4ebeef78fce0efeb10ac24b1c3aa27
SHA256

5035b54ba210173e82004291090b59c0630d17c45eadb48e9744f94303a2b891
SHA512

1d51e36a847a1b2a6ea0cc8e1b988386401c2b033344b5571fecb83a8da62848f61176a13fbd13c976aded4f915daa8fc7517fd5b08e6a35e4d0c53d05317176
SSDEEP

3072:hfHFz60KNUP7j4f/FW3gMTnkCnnvZsfwoKUjJRjqH9Z/oUHhXMG5Ra7l:hfHYbS4VJMTntnvZsIijJpqndXMG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 2624	5056	rundll32.exe	83
PID 5056 wrote to memory of 2624	5056	rundll32.exe	83
PID 5056 wrote to memory of 2624	5056	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQռ˵˵ɾ\iext.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQռ˵˵ɾ\iext.dll,#1
  2⤵
  PID:2624

memory/2624-132-0x0000000000000000-mapping.dmp

Download
memory/2624-133-0x0000000010000000-0x0000000010044000-memory.dmp

Filesize
272KB

Download