e2735c9c408eb63b77355359f71235f0c473f2eac14f9498c58e11e109b35d60

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 06:36

Target

eAPI.dll
Size

328KB
MD5

cbd788f4c71b9776660d6e8473ae0e09
SHA1

0189cd47bfa5d1cac0d7f1a33953d279f60b02bf
SHA256

db0a6d7b75503daaf93c8e62ce67abd3afd57daaef4a448ec25a43d1de69e47e
SHA512

84bc02c67e3a3a9f77418b25afe7ec55e5bb5ca5a6c05503d94dffa57a30c7608e79bb4f83fe91c39ccce16872df2b3f9e7e5a8eafb4f563b1f961b93e9b8c94
SSDEEP

3072:RML/WXLcZnh1Sn8v2jNGQHTBJu0Lo2nVXQdtzb9trTSh05LNZPyJPo/AfVsIwQ+w:RZbcZh1Su2dHm0JnYpRuVBwQ+6etZZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2380	3064	rundll32.exe	27
PID 3064 wrote to memory of 2380	3064	rundll32.exe	27
PID 3064 wrote to memory of 2380	3064	rundll32.exe	27
PID 3064 wrote to memory of 2380	3064	rundll32.exe	27
PID 3064 wrote to memory of 2380	3064	rundll32.exe	27
PID 3064 wrote to memory of 2380	3064	rundll32.exe	27
PID 3064 wrote to memory of 2380	3064	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\eAPI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\eAPI.dll,#1
  2⤵
  PID:2380