af87d20283c5cec59051cb75b19d7334fab9e724bfdda24a3c93890d34bd9f33

Analysis

max time kernel
259s
max time network
349s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 18:53

Target

af87d20283c5cec59051cb75b19d7334fab9e724bfdda24a3c93890d34bd9f33.dll
Size

45KB
MD5

918f030779d3bf2fa9daf1e774ca9339
SHA1

fe82391897fe5f83cfd187b62dd9e2e300648023
SHA256

af87d20283c5cec59051cb75b19d7334fab9e724bfdda24a3c93890d34bd9f33
SHA512

58b5d24f80f62e73418be640058884a6a67318553cdb9289041807ff10678d39f3d31f988339ee1c683b91e8e2c32f96a015797d286795eafd367e70dfe7535e
SSDEEP

768:awk1ODTj4q8t9K5jTQfbUT2cwn19Mb7SZsLawBR241lsIwq4Ox2ly:alIHj+qjcDUT2fvmW+2wr2KAq4Ox2k

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1664 2152 WerFault.exe rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

2152 rundll32.exe

pid	pid_target	process	target process
1664	2152	WerFault.exe	rundll32.exe

pid	process
2152	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4984 wrote to memory of 2152	4984	rundll32.exe	rundll32.exe
PID 4984 wrote to memory of 2152	4984	rundll32.exe	rundll32.exe
PID 4984 wrote to memory of 2152	4984	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af87d20283c5cec59051cb75b19d7334fab9e724bfdda24a3c93890d34bd9f33.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4984

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af87d20283c5cec59051cb75b19d7334fab9e724bfdda24a3c93890d34bd9f33.dll,#1
2⤵
- Suspicious use of SetWindowsHookEx
PID:2152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 796
3⤵
- Program crash
PID:1664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2152 -ip 2152
1⤵
PID:3916

memory/2152-132-0x0000000000000000-mapping.dmp

Download
memory/2152-133-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/2152-134-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download