ecb57522dcb65bb0210a561b94cb2751c96d6f737b6df6e98e6a9b7f22ab5df6

Analysis

max time kernel
91s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 22:59

Target

ecb57522dcb65bb0210a561b94cb2751c96d6f737b6df6e98e6a9b7f22ab5df6.dll
Size

359KB
MD5

4abf5f12ae8135fc4ed9a7408170d090
SHA1

2f4c243d0b794df40741a33fdc69d6fd118731ba
SHA256

ecb57522dcb65bb0210a561b94cb2751c96d6f737b6df6e98e6a9b7f22ab5df6
SHA512

e121e0f9ff2644a0ca2332a717b3191e6064ae3ed97ce32634c600b93a2c0e306f009c996b57e0a9ecff2cb994389df5d6dc5ced37f45d9b6d75946220a106e8
SSDEEP

6144:ligEwzuBmYaCDYyQi7ieC+b1taRZLLsUacr7pZ2GWLfvqffxOHF:l/LzuBHakt7ielxtaEcr7/ezF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 5068	2340	rundll32.exe	82
PID 2340 wrote to memory of 5068	2340	rundll32.exe	82
PID 2340 wrote to memory of 5068	2340	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ecb57522dcb65bb0210a561b94cb2751c96d6f737b6df6e98e6a9b7f22ab5df6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ecb57522dcb65bb0210a561b94cb2751c96d6f737b6df6e98e6a9b7f22ab5df6.dll,#1
  2⤵
  PID:5068

memory/5068-133-0x0000000073E70000-0x0000000073ECD000-memory.dmp

Filesize
372KB

Download
memory/5068-134-0x0000000073E70000-0x0000000073ECD000-memory.dmp

Filesize
372KB

Download