ec61c636e839e3ce7e1643fd00ac3dc9252b8a7a6396539e4303aabecc0d5ea7

Analysis

max time kernel
129s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 04:32

Target

ec61c636e839e3ce7e1643fd00ac3dc9252b8a7a6396539e4303aabecc0d5ea7.dll
Size

327KB
MD5

c1c4f18a8476524ab4aec9558c8b630f
SHA1

8d9e6a3c9456b1afdee18d023ffa8270709d51a2
SHA256

ec61c636e839e3ce7e1643fd00ac3dc9252b8a7a6396539e4303aabecc0d5ea7
SHA512

3c15dcbbcad111a61cf35c6df207017bb2470a5216754e4632c3a8d779e13a6b89e62ac08b97938a3dc19aca67cb7fe1f6fcdf606bec6cfb68cbaa414be52ef7
SSDEEP

6144:EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC48Ss9Ei:EmWhND9yJz+b1FcMLmp2AT8Ssd

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 1564	1248	rundll32.exe	83
PID 1248 wrote to memory of 1564	1248	rundll32.exe	83
PID 1248 wrote to memory of 1564	1248	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ec61c636e839e3ce7e1643fd00ac3dc9252b8a7a6396539e4303aabecc0d5ea7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ec61c636e839e3ce7e1643fd00ac3dc9252b8a7a6396539e4303aabecc0d5ea7.dll,#1
  2⤵
  PID:1564