80a1fd1ece493f72a864f3e60d1ea43e503b27a11a9d18234ec398337c574aaa

Analysis

max time kernel
30s
max time network
75s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 05:47

Target

QQռ˵˵ɾ/shellEx.dll
Size

15KB
MD5

b7e1723830b9ada6d82aee8adbb65e02
SHA1

6d0fb1602f82a58e26ccfcc3ce9c1f483fd23b8d
SHA256

62415bf977b184c5b9db0659312d8d52a7521a68656e2a9442b5bcf9fa6b9194
SHA512

6ad9716359b9f24bd773985131b30572e7e8eec53b9913299b6780f2528b741f2ec372e966777cc70464204b59a50c8ceb2ad6ed399d373a08a8a1f187c4d02c
SSDEEP

192:gBs2jSYI4UdRBQF84R4ojAFUFyQtpgbKLBKiUJvKvrYxMOksA57S6F:qSyqPQFb+YBgbKLBKiUJvCrojk1F

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 764	1144	rundll32.exe	26
PID 1144 wrote to memory of 764	1144	rundll32.exe	26
PID 1144 wrote to memory of 764	1144	rundll32.exe	26
PID 1144 wrote to memory of 764	1144	rundll32.exe	26
PID 1144 wrote to memory of 764	1144	rundll32.exe	26
PID 1144 wrote to memory of 764	1144	rundll32.exe	26
PID 1144 wrote to memory of 764	1144	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQռ˵˵ɾ\shellEx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQռ˵˵ɾ\shellEx.dll,#1
  2⤵
  PID:764

memory/764-55-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download