f5d7e68787bf6fc317f7d3af3e6a6a2a1683dd573ab67a5c059afed9868a33b7

Analysis

max time kernel
99s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2022 18:33

Target

f5d7e68787bf6fc317f7d3af3e6a6a2a1683dd573ab67a5c059afed9868a33b7.dll
Size

860KB
MD5

93f7bd2fffecb2ad25858e49415e7bc9
SHA1

b62cbabb47aaedf4aff42dc64f73a50b2f55bea3
SHA256

f5d7e68787bf6fc317f7d3af3e6a6a2a1683dd573ab67a5c059afed9868a33b7
SHA512

9cf02d9a68e5635566ddf5af396b2bdd20f7d1291eb07b59b312389d6cd5a91ded4be5539a098dcbb3fc51e63f5ee6db6c562f11b405c67867c036a0c72d7204
SSDEEP

12288:XbRjdQWRdOaMj+JR3Y57H3Rz0smutNjRua4Wr:Xb9lRdOLjIRK7XdLNjR8Wr

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3744	3908	WerFault.exe	81

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3908	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 3908	2236	rundll32.exe	81
PID 2236 wrote to memory of 3908	2236	rundll32.exe	81
PID 2236 wrote to memory of 3908	2236	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f5d7e68787bf6fc317f7d3af3e6a6a2a1683dd573ab67a5c059afed9868a33b7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f5d7e68787bf6fc317f7d3af3e6a6a2a1683dd573ab67a5c059afed9868a33b7.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 784
    3⤵
    - Program crash
    PID:3744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3908 -ip 3908
1⤵
PID:1032