eca9250aee39851490914888d6fb8042a8f14ad411bf6ede44cbb91110abc395

Analysis

max time kernel
91s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12-06-2024 06:30

Target

eca9250aee39851490914888d6fb8042a8f14ad411bf6ede44cbb91110abc395.dll
Size

5KB
MD5

44de8272325bd3978e65a7f0ef603f10
SHA1

042389104863f3432b4c93126fd2821defeef7e1
SHA256

eca9250aee39851490914888d6fb8042a8f14ad411bf6ede44cbb91110abc395
SHA512

a65ad532bce301c958d2cdced5a5cd6fc4dae25bfba04574aa49039dcfd4c25921dc5ef5dcaf9f08d87802321e1894147f3afb1b5a730d386a3a38220336c4eb
SSDEEP

96:hy859x0P8MaB39CvqEZEkPMP/rH1IJWLFzij:F5oLCbUaXrHaJS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 1904	2624	rundll32.exe	79
PID 2624 wrote to memory of 1904	2624	rundll32.exe	79
PID 2624 wrote to memory of 1904	2624	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\eca9250aee39851490914888d6fb8042a8f14ad411bf6ede44cbb91110abc395.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\eca9250aee39851490914888d6fb8042a8f14ad411bf6ede44cbb91110abc395.dll,#1
  2⤵
  PID:1904