ebcd66cb4c54e23846bbe502a05564dfc71f6e412faeadc52a092c73eb7deb2f

Analysis

max time kernel
0s
max time network
23s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2023, 03:35

Target

ebcd66cb4c54e23846bbe502a05564dfc71f6e412faeadc52a092c73eb7deb2f.dll
Size

82KB
MD5

e3571a16f67482e4614ea047b9d7f1e7
SHA1

27692eafcf957721e1935f52d23e4a92ff3ebc92
SHA256

ebcd66cb4c54e23846bbe502a05564dfc71f6e412faeadc52a092c73eb7deb2f
SHA512

24d0c47e6e5784e5652d37c8f51d7cf2b6f912a626db18ed20dc004f9d4fe8bb8ee538ae66ea9c84a7e87b03668b36b14deeff7972af7e3876b1b7b3ce7f5370
SSDEEP

1536:v/aSQsL7NNm1eHeYFKi0BYyFkKp/qUOJ7WSTCsWzD2cdbwpWkr7ePpms:9QqG1geYF56FkBq8gD3bOWkraPpm

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 408 set thread context of 1652	408	rundll32.exe	87

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 408	2224	rundll32.exe	53
PID 2224 wrote to memory of 408	2224	rundll32.exe	53
PID 2224 wrote to memory of 408	2224	rundll32.exe	53
PID 408 wrote to memory of 1652	408	rundll32.exe	87
PID 408 wrote to memory of 1652	408	rundll32.exe	87
PID 408 wrote to memory of 1652	408	rundll32.exe	87
PID 408 wrote to memory of 1652	408	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ebcd66cb4c54e23846bbe502a05564dfc71f6e412faeadc52a092c73eb7deb2f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ebcd66cb4c54e23846bbe502a05564dfc71f6e412faeadc52a092c73eb7deb2f.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:408
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe
    3⤵
    PID:1652