256b2b603195d3c4a30c4c4ebd0db38859d0d0b2435d96005119b8f63fa6f410

Analysis

max time kernel
28s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 06:45

Target

ͨͷQQӺ V.4.4 ʽ /eAPI.dll
Size

308KB
MD5

7c1ff88991f5eafab82b1beaefc33a42
SHA1

5ea338434c4c070aaf4e4e3952b4b08b551267bc
SHA256

53483523c316ad8c022c2b07a5cabfff3339bc5cb5e4ac24c3260eea4f4d9731
SHA512

310c90c82b545160420375c940b4d6176400e977f74048bfe2e0d0784bc167b361dc7aac149b8379f6e24050a253f321a6606295414ea9b68a563d59d0d17a48
SSDEEP

6144:yE+ULyjYsLavN8JFhOyccPT8oV2wQfRayWjG:yoWRVXUyhIoIwQ4VG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 972	1952	rundll32.exe	28
PID 1952 wrote to memory of 972	1952	rundll32.exe	28
PID 1952 wrote to memory of 972	1952	rundll32.exe	28
PID 1952 wrote to memory of 972	1952	rundll32.exe	28
PID 1952 wrote to memory of 972	1952	rundll32.exe	28
PID 1952 wrote to memory of 972	1952	rundll32.exe	28
PID 1952 wrote to memory of 972	1952	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ͨͷQQӺ V.4.4 ʽ \eAPI.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ͨͷQQӺ V.4.4 ʽ \eAPI.dll",#1
  2⤵
  PID:972

memory/972-55-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download