4a0ef352bd24ff1b1ffe0b8307fb809d1732638853c12f87866f994cca072098

Analysis

max time kernel
240s
max time network
255s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 09:43

Target

4a0ef352bd24ff1b1ffe0b8307fb809d1732638853c12f87866f994cca072098.dll
Size

982KB
MD5

2360090c7e4ac31056cd2992831738ad
SHA1

7f5744e486d00663136dc7316677ca1c7570750a
SHA256

4a0ef352bd24ff1b1ffe0b8307fb809d1732638853c12f87866f994cca072098
SHA512

8d9e2bd276a5a8019e1ef61fb438e542d18ff423a41b4d842b304ac5cf553cfa516755d06ae079e7e794e077abfaa56bd28391f1504849abbe25238d9e952633
SSDEEP

24576:Xm350aOUl3O2hKHG3jFrAiLGgLpdWiYwSLcz:XmG5m3hrAi6M/Yi

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3896	4724	WerFault.exe	81

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4724	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 4724	4660	rundll32.exe	81
PID 4660 wrote to memory of 4724	4660	rundll32.exe	81
PID 4660 wrote to memory of 4724	4660	rundll32.exe	81
PID 4724 wrote to memory of 3896	4724	rundll32.exe	84
PID 4724 wrote to memory of 3896	4724	rundll32.exe	84
PID 4724 wrote to memory of 3896	4724	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a0ef352bd24ff1b1ffe0b8307fb809d1732638853c12f87866f994cca072098.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a0ef352bd24ff1b1ffe0b8307fb809d1732638853c12f87866f994cca072098.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 756
    3⤵
    - Program crash
    PID:3896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4724 -ip 4724
1⤵
PID:3748

memory/4724-133-0x00000000023A0000-0x00000000026C7000-memory.dmp

Filesize
3.2MB

Download
memory/4724-134-0x00000000023A0000-0x00000000026C7000-memory.dmp

Filesize
3.2MB

Download
memory/4724-135-0x00000000023A0000-0x00000000026C7000-memory.dmp

Filesize
3.2MB

Download
memory/4724-136-0x00000000023A0000-0x00000000026C7000-memory.dmp

Filesize
3.2MB

Download
memory/4724-137-0x00000000023A0000-0x00000000026C7000-memory.dmp

Filesize
3.2MB

Download
memory/4724-138-0x00000000023A0000-0x00000000026C7000-memory.dmp

Filesize
3.2MB

Download
memory/4724-139-0x00000000023A0000-0x00000000026C7000-memory.dmp

Filesize
3.2MB

Download