2e61abd663a7e5831ef7f39440edc4fbf61aff50516d939490624cc94736a41c

Analysis

max time kernel
143s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 18:38

Target

ECC.5.3/ECC.5.3.dll
Size

216KB
MD5

e3a93be8df617779d35992a87ff548b5
SHA1

8553df58567b39d1f848bae6cd9d463a2a5d99b9
SHA256

1c9e9a1e3691ebf8b32ddba9033b6fd7bd028cc539e36ff2d3db3cb807dbf790
SHA512

107d5fbcd78caf11eac0e651073be2c0472e8da04ed5eb78b7fb3ec2053dbd33428d1c8024a3a4b2dc1bbb1cac6aa7333e7fdcb77d99551fa819aa66c678505a
SSDEEP

3072:09HOUXjmrIu9yJ+d5zqQrL6K/sL1QEauRelEzMz0jt+rRtVlUlxup:0xmrr55eQvTg1hElEYz0sglxu

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4232	2396	WerFault.exe	89
4564	2396	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3460 wrote to memory of 2396	3460	rundll32.exe	89
PID 3460 wrote to memory of 2396	3460	rundll32.exe	89
PID 3460 wrote to memory of 2396	3460	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ECC.5.3\ECC.5.3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ECC.5.3\ECC.5.3.dll,#1
  2⤵
  PID:2396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 588
    3⤵
    - Program crash
    PID:4232
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 792
    3⤵
    - Program crash
    PID:4564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2396 -ip 2396
1⤵
PID:3408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2396 -ip 2396
1⤵
PID:452