16e82bd509cf326cc7b3239459f80196bdde1fb15cad21e03e48189e4e73f857

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21-04-2024 16:08

Target

taobao_qunfa_5.70/eAPI.dll
Size

328KB
MD5

cbd788f4c71b9776660d6e8473ae0e09
SHA1

0189cd47bfa5d1cac0d7f1a33953d279f60b02bf
SHA256

db0a6d7b75503daaf93c8e62ce67abd3afd57daaef4a448ec25a43d1de69e47e
SHA512

84bc02c67e3a3a9f77418b25afe7ec55e5bb5ca5a6c05503d94dffa57a30c7608e79bb4f83fe91c39ccce16872df2b3f9e7e5a8eafb4f563b1f961b93e9b8c94
SSDEEP

3072:RML/WXLcZnh1Sn8v2jNGQHTBJu0Lo2nVXQdtzb9trTSh05LNZPyJPo/AfVsIwQ+w:RZbcZh1Su2dHm0JnYpRuVBwQ+6etZZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4828 wrote to memory of 4476	4828	rundll32.exe	rundll32.exe
PID 4828 wrote to memory of 4476	4828	rundll32.exe	rundll32.exe
PID 4828 wrote to memory of 4476	4828	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\taobao_qunfa_5.70\eAPI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4828

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\taobao_qunfa_5.70\eAPI.dll,#1
2⤵
PID:4476