daffaa21f751d95ca7461a21f4b49718a66fd7a2391dd0d96643ace0e9afcb43

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 10:53

Target

dwzhq/zjhs/eAPI.dll
Size

328KB
MD5

d0e0d53a970aaa7068bdb41a6b8a7c5a
SHA1

b4fde4e2b7924e1fd76c094a5a7244d1fd351700
SHA256

6898d235f653db69a96a614259a6512db1a89b638d3c00dfaa72339595d3bdfe
SHA512

f4dfd2e64f0505861286fe71cf272119518b1e0b18e4ea3095d62c616fcd6d6dff953218fff8da6d42343303d56a9eee815f0ba3ab16c6514e1fe19fdb8c7660
SSDEEP

3072:KMxwh0qOZTNIDHIGR3CpQACIphnZRHOYEQjmL+Z+x619ej0JPozAfV/bxBFwQ+7O:KMxc0xZToHIrHphnZRB/AUVNwQ+7Tr5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 4272	4260	rundll32.exe	82
PID 4260 wrote to memory of 4272	4260	rundll32.exe	82
PID 4260 wrote to memory of 4272	4260	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dwzhq\zjhs\eAPI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dwzhq\zjhs\eAPI.dll,#1
  2⤵
  PID:4272