0a3621266e47dc68917eaf421731de59cd25aa7c2594c03e1ce1724a2ae025ec

Analysis

max time kernel
91s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2022, 20:06

Target

0a3621266e47dc68917eaf421731de59cd25aa7c2594c03e1ce1724a2ae025ec.dll
Size

382KB
MD5

d660acae39ad3764c14f057169e75b81
SHA1

d93c1686ca70a2f561ff93eb31b507a8b865e21a
SHA256

0a3621266e47dc68917eaf421731de59cd25aa7c2594c03e1ce1724a2ae025ec
SHA512

7542295510eea15986dc8123859ffe6f5b71e8fc1975c5bda740808fd5507ac0bc0c96c05701fad99f7ea62e66da0572f495c6c37eb11d7330fe23bf2583baff
SSDEEP

6144:q2MnPGBYklnxB31CMR/v6qWRX8by+AH3zYowtlhR9iorCqbw+ugYyE77/mXLLR:qrUN9X6qxm38oYlhRBrCqbX1k7/w5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1664	1340	WerFault.exe	81

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1340	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 1340	4376	rundll32.exe	81
PID 4376 wrote to memory of 1340	4376	rundll32.exe	81
PID 4376 wrote to memory of 1340	4376	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a3621266e47dc68917eaf421731de59cd25aa7c2594c03e1ce1724a2ae025ec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a3621266e47dc68917eaf421731de59cd25aa7c2594c03e1ce1724a2ae025ec.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1340
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 692
    3⤵
    - Program crash
    PID:1664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1340 -ip 1340
1⤵
PID:2960

memory/1340-134-0x0000000010000000-0x00000000100E8000-memory.dmp

Filesize
928KB

Download
memory/1340-135-0x0000000010000000-0x00000000100E8000-memory.dmp

Filesize
928KB

Download
memory/1340-133-0x0000000010000000-0x00000000100E8000-memory.dmp

Filesize
928KB

Download
memory/1340-138-0x0000000010000000-0x00000000100E8000-memory.dmp

Filesize
928KB

Download
memory/1340-137-0x0000000010000000-0x00000000100E8000-memory.dmp

Filesize
928KB

Download
memory/1340-139-0x0000000010000000-0x00000000100E8000-memory.dmp

Filesize
928KB

Download
memory/1340-140-0x0000000010000000-0x00000000100E8000-memory.dmp

Filesize
928KB

Download
memory/1340-141-0x0000000010000000-0x00000000100E8000-memory.dmp

Filesize
928KB

Download