40224b10f6543ea1a26bffadfe91c22233b2828118203cbd81b528c2fd592901

Analysis

max time kernel
90s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2022, 22:51

Target
40224b10f6543ea1a26bffadfe91c22233b2828118203cbd81b528c2fd592901.dll
Size 736KB
Sample221031-2sw1jsdhd7
SHA256 40224b10f6543ea1a26bffadfe91c22233b2828118203cbd81b528c2fd592901
MD5 a145dc31e3accf25664dd91d2eff6458
SHA1 d97c99bf29d89987d102947c0f36f4c1d5d43cfc
SHA512 cfd92694301151a4b25b645835dbebcded86632684ce397d352558dfa9984a6b3c22adb4468daef18624fd947473c0de7bc2918b409616101662d0a3c4388314
SSDEEP 12288:Zbm39NuDQwXvSaEkBr8sIkDbh2modm/Dzheaj:Zi39NQQIvSDkR8nkR2modm7zheM
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4868	4904	WerFault.exe	80

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4904	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 4904	1616	rundll32.exe	80
PID 1616 wrote to memory of 4904	1616	rundll32.exe	80
PID 1616 wrote to memory of 4904	1616	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\40224b10f6543ea1a26bffadfe91c22233b2828118203cbd81b528c2fd592901.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\40224b10f6543ea1a26bffadfe91c22233b2828118203cbd81b528c2fd592901.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4904
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 692
    3⤵
    - Program crash
    PID:4868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4904 -ip 4904
1⤵
PID:4796