34c35e5e18354f9e459e792a3f8bb40af5b18787f0461078ba563b5d49aa6292

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21-07-2024 22:32

Target

Clanwar1.0/EzIMClientModule.dll
Size

424KB
MD5

bc292a40ceaed5b8b8a61fa472b69b2a
SHA1

1e6d81a43c030ce5d4cc5267ce1adaf298fedb1d
SHA256

7b518889eb63355ddc5d334c45e081866e4ef41c9f8a7a911e345a5535906ca1
SHA512

596640a33c0ed5b0cb191597927126dd25d1f3c551a26e6204f3a8bdd9ce10e9757d55449b32668971f51a8b8b2aa36439c8645d09abe80e1d1839fe0d7a8c86
SSDEEP

6144:ttFyfQZMatkZOCvH92CVd6IB06a0Tx0vv/DNp/xPXSPKeQpUhV6YAOe0etmxj:RyfQZM+GOo9LTta0Ty/DRPX9eVgYD

Score

5^/10

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\EzImLog\EzImClientModule.log	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\EZIMLog\NetLib\2024-07\21.log	rundll32.exe
File created	C:\Windows\SysWOW64\EZIMLog\NetLib\2024-07\21.log	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\EzImLog\UDPStream.log	rundll32.exe
File created	C:\Windows\SysWOW64\EzImLog\UDPStream.log	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\EzImLog\EzImClientModule.log	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2704	2688	rundll32.exe	30
PID 2688 wrote to memory of 2704	2688	rundll32.exe	30
PID 2688 wrote to memory of 2704	2688	rundll32.exe	30
PID 2688 wrote to memory of 2704	2688	rundll32.exe	30
PID 2688 wrote to memory of 2704	2688	rundll32.exe	30
PID 2688 wrote to memory of 2704	2688	rundll32.exe	30
PID 2688 wrote to memory of 2704	2688	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Clanwar1.0\EzIMClientModule.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Clanwar1.0\EzIMClientModule.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:2704

memory/2704-0-0x0000000000120000-0x0000000000146000-memory.dmp

Filesize
152KB

Download
memory/2704-1-0x0000000000150000-0x000000000016C000-memory.dmp

Filesize
112KB

Download
memory/2704-3-0x0000000000220000-0x000000000027E000-memory.dmp

Filesize
376KB

Download
memory/2704-4-0x00000000002C0000-0x000000000031C000-memory.dmp

Filesize
368KB

Download
memory/2704-6-0x00000000003F0000-0x000000000044B000-memory.dmp

Filesize
364KB

Download