ecb57522dcb65bb0210a561b94cb2751c96d6f737b6df6e98e6a9b7f22ab5df6

Analysis

max time kernel
3s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 22:59

Target

ecb57522dcb65bb0210a561b94cb2751c96d6f737b6df6e98e6a9b7f22ab5df6.dll
Size

359KB
MD5

4abf5f12ae8135fc4ed9a7408170d090
SHA1

2f4c243d0b794df40741a33fdc69d6fd118731ba
SHA256

ecb57522dcb65bb0210a561b94cb2751c96d6f737b6df6e98e6a9b7f22ab5df6
SHA512

e121e0f9ff2644a0ca2332a717b3191e6064ae3ed97ce32634c600b93a2c0e306f009c996b57e0a9ecff2cb994389df5d6dc5ced37f45d9b6d75946220a106e8
SSDEEP

6144:ligEwzuBmYaCDYyQi7ieC+b1taRZLLsUacr7pZ2GWLfvqffxOHF:l/LzuBHakt7ielxtaEcr7/ezF

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1352	2036	rundll32.exe	28
PID 2036 wrote to memory of 1352	2036	rundll32.exe	28
PID 2036 wrote to memory of 1352	2036	rundll32.exe	28
PID 2036 wrote to memory of 1352	2036	rundll32.exe	28
PID 2036 wrote to memory of 1352	2036	rundll32.exe	28
PID 2036 wrote to memory of 1352	2036	rundll32.exe	28
PID 2036 wrote to memory of 1352	2036	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ecb57522dcb65bb0210a561b94cb2751c96d6f737b6df6e98e6a9b7f22ab5df6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ecb57522dcb65bb0210a561b94cb2751c96d6f737b6df6e98e6a9b7f22ab5df6.dll,#1
  2⤵
  PID:1352

memory/1352-55-0x00000000760B1000-0x00000000760B3000-memory.dmp

Filesize
8KB

Download
memory/1352-56-0x0000000073E70000-0x0000000073ECD000-memory.dmp

Filesize
372KB

Download
memory/1352-57-0x0000000073E71000-0x0000000073EC6000-memory.dmp

Filesize
340KB

Download
memory/1352-58-0x0000000073E70000-0x0000000073ECD000-memory.dmp

Filesize
372KB

Download