ef965f7a0ce63b03f2d5b936c3ede0b7b8de63ce59e8b2ff79745bdb00111a62

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 17:09

Target

ChiitransLite/tools/le/LocaleEmulator.dll
Size

42KB
MD5

09f3ecffa133250318b062f95a8a56cd
SHA1

1dfe7d8bab56548dd766d451e41a272331e8c4d1
SHA256

d58b196f40e6cf0be603565376745db4fc10f5f0a6a129f38a891b9196c863c2
SHA512

fe56ef56330ce9364bebaed537c5636d923953283c1d22560bfebecf303aa653686f60625e06c2e51cc0d99b21722247854c7352e4e56e6232a7c63e601a5145
SSDEEP

768:7HPgr21qXq3jZsjODBS+xNlBCR8AYBKmTFczP1S+1GWRFhP:u2Plsj0ERJ4Kw6P1SKjh

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 2272	1624	rundll32.exe	28
PID 1624 wrote to memory of 2272	1624	rundll32.exe	28
PID 1624 wrote to memory of 2272	1624	rundll32.exe	28
PID 1624 wrote to memory of 2272	1624	rundll32.exe	28
PID 1624 wrote to memory of 2272	1624	rundll32.exe	28
PID 1624 wrote to memory of 2272	1624	rundll32.exe	28
PID 1624 wrote to memory of 2272	1624	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ChiitransLite\tools\le\LocaleEmulator.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ChiitransLite\tools\le\LocaleEmulator.dll,#1
  2⤵
  PID:2272

memory/2272-2-0x00000000752C0000-0x00000000752CC000-memory.dmp

Filesize
48KB

Download
memory/2272-1-0x0000000075070000-0x000000007507C000-memory.dmp

Filesize
48KB

Download
memory/2272-0-0x00000000752C0000-0x00000000752CC000-memory.dmp

Filesize
48KB

Download
memory/2272-3-0x0000000075070000-0x000000007507C000-memory.dmp

Filesize
48KB

Download