ecd06317d1aa76022d3a3b804eeb0929e1d18b7014a3d9714a0423b06f695829

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 20:24

Target

ecd06317d1aa76022d3a3b804eeb0929e1d18b7014a3d9714a0423b06f695829.dll
Size

76KB
MD5

58a9fb53a5bfc1752f079ea294242870
SHA1

eeced018e0deadc38234b3874847f9039d9be9ed
SHA256

ecd06317d1aa76022d3a3b804eeb0929e1d18b7014a3d9714a0423b06f695829
SHA512

6d1143b5a7111f88294a2209cd4da4ae9d1a2a00e6dc18b2f4904ca11d3325fd074b02d8a671243ef3f1ca9fb0eb014e107a99ac081a78e373be9cfa72fb8fa3
SSDEEP

1536:IykzkagpyHkPndLmuTGpwPTAMANKLDrHh6cxwevnVYV:IFzkapEFauTAdhNKLD5uW+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 4844	4948	rundll32.exe	81
PID 4948 wrote to memory of 4844	4948	rundll32.exe	81
PID 4948 wrote to memory of 4844	4948	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ecd06317d1aa76022d3a3b804eeb0929e1d18b7014a3d9714a0423b06f695829.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ecd06317d1aa76022d3a3b804eeb0929e1d18b7014a3d9714a0423b06f695829.dll,#1
  2⤵
  PID:4844

memory/4844-133-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download