d1505a8ac2409207637b344848d53a2e189a04873ebc87ac3155f7cd05b0e348

Analysis

max time kernel
177s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 20:52

Target

hintdm.dll
Size

218KB
MD5

bcda7604a68ad5061daf9cfb38fa0300
SHA1

d85930ef910a5f74d16eb2e308c5a2550bdf19d3
SHA256

74b0f7a9d2225d4d8580d801957d05b8229d5e8098327772150ea071ecc9ea36
SHA512

796a60a937651efbbd6ca30fcb916177f0bf594343a8a8f2a3efbe47f791f5145c2844e3adeb6248c26fc1173f843902bc82993fc6a535d57d838bc211ad3a36
SSDEEP

3072:4qP97WTO5gUYWT+wE80CrzgMz10fjgPPLZcpLg2Ra7mxxTIik9glk7JRBD2t+qG2:VWTOq9WTj/n08Pzyq9mxVIz9FzI+a

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

216 1368 WerFault.exe rundll32.exe

pid	pid_target	process	target process
216	1368	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2112 wrote to memory of 1368	2112	rundll32.exe	rundll32.exe
PID 2112 wrote to memory of 1368	2112	rundll32.exe	rundll32.exe
PID 2112 wrote to memory of 1368	2112	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hintdm.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2112

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hintdm.dll,#1
2⤵
PID:1368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 648
3⤵
- Program crash
PID:216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 1368 -ip 1368
1⤵
PID:2912