1db15fbe534fc563ec0ab7732aca4dd6310069487ca37108e3f0bf123681ca4d

Analysis

max time kernel
91s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2022, 20:06

Target

1db15fbe534fc563ec0ab7732aca4dd6310069487ca37108e3f0bf123681ca4d.dll
Size

1.1MB
MD5

7aae7fb6b5b57e2e6543e795a4541e29
SHA1

8c4ca6ddee4f9b2f2d591dc8e326d5a03b91bddc
SHA256

1db15fbe534fc563ec0ab7732aca4dd6310069487ca37108e3f0bf123681ca4d
SHA512

96570a9a17a8a7797e8b2e1b9480948a246274737961e804de4feb220e8316265f75ef3d6a99d488f8ef73ea2cabcd930f1f1129cfb2f8a1dd3aaaf2a6ce4e90
SSDEEP

24576:tm+LRtxu99RlKyXaOwOTWpBHsuY7xClsWvthj1UMhJB1Yu+D:NRrpOuY7wvthZUMhJQu+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4936	3036	WerFault.exe	82

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3036	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 3036	3544	rundll32.exe	82
PID 3544 wrote to memory of 3036	3544	rundll32.exe	82
PID 3544 wrote to memory of 3036	3544	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1db15fbe534fc563ec0ab7732aca4dd6310069487ca37108e3f0bf123681ca4d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1db15fbe534fc563ec0ab7732aca4dd6310069487ca37108e3f0bf123681ca4d.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 808
    3⤵
    - Program crash
    PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3036 -ip 3036
1⤵
PID:4968

memory/3036-133-0x0000000002420000-0x000000000280E000-memory.dmp

Filesize
3.9MB

Download
memory/3036-134-0x0000000002420000-0x000000000280E000-memory.dmp

Filesize
3.9MB

Download
memory/3036-135-0x0000000002420000-0x000000000280E000-memory.dmp

Filesize
3.9MB

Download
memory/3036-136-0x0000000002420000-0x000000000280E000-memory.dmp

Filesize
3.9MB

Download
memory/3036-137-0x0000000002420000-0x000000000280E000-memory.dmp

Filesize
3.9MB

Download