21422f8dffcd0e9191c7af77b416622382e4fd9a1fc38b96ab3e11494e8d9ceb

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 09:04

Target

易语言邮箱客户端/iext2.dll
Size

492KB
MD5

dba5fdbe7ec94463b3f6fdf2162c9f95
SHA1

a97137b4f2b77166b2a23da1f58e0bdb7365f4f2
SHA256

a8b14f31098a191631696db5ddc77e029b48999542e0ec15b63df02220c66d37
SHA512

325439bb5fe0e18e08cd547e9e9d505aa5b1ee51a436cb155254cfb04d318679e7a016cc2e72ffaba49bed20e15e85b26fd2a22e726e211650317218dde53ba6
SSDEEP

6144:0ujp9xZF+ES6jisyHOzC8QxEksWINE1DfYmgykSjsUgZ43KyEBuXwKF:VZFX5zC8XkBIm1DfYml7otm3YBu

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2868 wrote to memory of 2972	2868	rundll32.exe	rundll32.exe
PID 2868 wrote to memory of 2972	2868	rundll32.exe	rundll32.exe
PID 2868 wrote to memory of 2972	2868	rundll32.exe	rundll32.exe
PID 2868 wrote to memory of 2972	2868	rundll32.exe	rundll32.exe
PID 2868 wrote to memory of 2972	2868	rundll32.exe	rundll32.exe
PID 2868 wrote to memory of 2972	2868	rundll32.exe	rundll32.exe
PID 2868 wrote to memory of 2972	2868	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\易语言邮箱客户端\iext2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2868

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\易语言邮箱客户端\iext2.dll,#1
2⤵
PID:2972