256b2b603195d3c4a30c4c4ebd0db38859d0d0b2435d96005119b8f63fa6f410

Analysis

max time kernel
8s
max time network
29s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 06:45

Target

ͨͷQQӺ V.4.4 ʽ /edroptarget.dll
Size

156KB
MD5

ca77aec89bd2f81bbef77ff26b88148a
SHA1

27e8eb70f218d5d085344fce21653dc31e0dda29
SHA256

1eaf42e6c734eb332f0edf7d3cf7c408f72b3267ae5408675d3604a6b23319d2
SHA512

985592f5a0c5916b1dc83079f17abb0fb4fb20aeb8b9a9d6ffd1b196eeda45d5d2393654cee3e6c1405d431f2fd55403ce734d75a948fdc56fea2d67217067cf
SSDEEP

1536:Mlmu0yIWJYXLgb70TeNBmcnJwm+4zzZj2cyowaIezzUSTqigIZntGoWkiOD2OWrL:Mlmu0yPSb+bSm+gZNKZfDoWkVTj1eF

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 1260	828	rundll32.exe	28
PID 828 wrote to memory of 1260	828	rundll32.exe	28
PID 828 wrote to memory of 1260	828	rundll32.exe	28
PID 828 wrote to memory of 1260	828	rundll32.exe	28
PID 828 wrote to memory of 1260	828	rundll32.exe	28
PID 828 wrote to memory of 1260	828	rundll32.exe	28
PID 828 wrote to memory of 1260	828	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ͨͷQQӺ V.4.4 ʽ \edroptarget.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ͨͷQQӺ V.4.4 ʽ \edroptarget.dll",#1
  2⤵
  PID:1260

memory/1260-55-0x0000000075C41000-0x0000000075C43000-memory.dmp

Filesize
8KB

Download