80a1fd1ece493f72a864f3e60d1ea43e503b27a11a9d18234ec398337c574aaa

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 05:47

Target

QQռ˵˵ɾ/internet.dll
Size

188KB
MD5

30ed482f82e5dd22889f1793fb059373
SHA1

171f79e8300c2d0a73bf64dd39743a218540eee2
SHA256

eeddb86a003915ea33b90e7eb533c5a58875b1669bf7e279d116391bc9a34391
SHA512

3dc2faa0cf9f3ed5b8ce81445d245628f660600f02cebfcc5ad4843235664a9102071e3d64bb21a3667ce300bba67d7ed499bab1254376e9b9415f39a7ed3f0a
SSDEEP

3072:+JQn9C8I+od+guN9P1nqp4JM55txdN8mW0UYsCV7IPThpEbbAKNXoql3VJbr0Zy9:+I9HI+od+ge1nqpbjLdN8mnVso7AThpE

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 1836	1760	rundll32.exe	28
PID 1760 wrote to memory of 1836	1760	rundll32.exe	28
PID 1760 wrote to memory of 1836	1760	rundll32.exe	28
PID 1760 wrote to memory of 1836	1760	rundll32.exe	28
PID 1760 wrote to memory of 1836	1760	rundll32.exe	28
PID 1760 wrote to memory of 1836	1760	rundll32.exe	28
PID 1760 wrote to memory of 1836	1760	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQռ˵˵ɾ\internet.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQռ˵˵ɾ\internet.dll,#1
  2⤵
  PID:1836

memory/1836-54-0x0000000000000000-mapping.dmp

Download
memory/1836-55-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download