ecc6cb3be0db2bb403f3c3e151e971d1f84eeedf6fb13129174587a242c0a1ef

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-03-2024 18:58

Target

ecc6cb3be0db2bb403f3c3e151e971d1f84eeedf6fb13129174587a242c0a1ef.dll
Size

50KB
MD5

fb6f5bdd7a9f2d83cea8285d49bd9910
SHA1

6b52778a4b5961fe288d1764d45e5b6a92b104da
SHA256

ecc6cb3be0db2bb403f3c3e151e971d1f84eeedf6fb13129174587a242c0a1ef
SHA512

f0275886883ed18e7905e5fe496ad331366e1ba97f273622dfc1165e2ef863b8b1987c66a2892013acc454c658abda8b570ce4de84827421ad869c55b6be7ff6
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5+JYH:W5ReWjTrW9rNPgYocJYH

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1692	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 1692	4236	rundll32.exe	86
PID 4236 wrote to memory of 1692	4236	rundll32.exe	86
PID 4236 wrote to memory of 1692	4236	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ecc6cb3be0db2bb403f3c3e151e971d1f84eeedf6fb13129174587a242c0a1ef.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ecc6cb3be0db2bb403f3c3e151e971d1f84eeedf6fb13129174587a242c0a1ef.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1692