ebc63f98c08553965eaab4b08e3bd0d5e1f66747be6b103eaf9462103a0c5e59

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 12:33

Target

ebc63f98c08553965eaab4b08e3bd0d5e1f66747be6b103eaf9462103a0c5e59.dll
Size

204KB
MD5

ac00de3679b8fcd414b0da4908de4720
SHA1

70c83f3aed568844fb545ce19b4ef5ffd9d78d04
SHA256

ebc63f98c08553965eaab4b08e3bd0d5e1f66747be6b103eaf9462103a0c5e59
SHA512

01841f358db3fed89d0d0efa8b8af400b3a16ed3b566feb687e80fb9ec0853ad482209b89118fdcbf8ea6e61eadf2deefa4339abec85628fe90c9a301b9671b2
SSDEEP

3072:6eiMiBX7iWtXpdyDIYiD0cx3JXNbWqcZK3VYYHS/c2RhvmA0qHRcO5Vnk1XD6qmy:Amm7x5MZAHT6JuL

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 2608	4876	rundll32.exe	82
PID 4876 wrote to memory of 2608	4876	rundll32.exe	82
PID 4876 wrote to memory of 2608	4876	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ebc63f98c08553965eaab4b08e3bd0d5e1f66747be6b103eaf9462103a0c5e59.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ebc63f98c08553965eaab4b08e3bd0d5e1f66747be6b103eaf9462103a0c5e59.dll,#1
  2⤵
  PID:2608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2608 -ip 2608
1⤵
PID:1352