e60bc161066dabea97cea12bd8559fa64884c7486108c1d09f83d97b84ce4fb4

Analysis

max time kernel
181s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 19:14

Target

e60bc161066dabea97cea12bd8559fa64884c7486108c1d09f83d97b84ce4fb4.dll
Size

644KB
MD5

537d3a75e7ac3d7870449a9fd6587aed
SHA1

3a21481cdcd472ddb1d389ab4fc37272d10748da
SHA256

e60bc161066dabea97cea12bd8559fa64884c7486108c1d09f83d97b84ce4fb4
SHA512

f4d7aa579eecfda43377d1c295be554653acbc7335c1b056a32107d3ece6c5997869e4e1df98179a36be8b86a4d05e6c26b79a38dc8cc501464e2a5b031638ba
SSDEEP

12288:N6mj/bV8sxIW8USgfNpfrBjzLXwb5IfcJp8Mi/9LgBRIK5/:cmzhpxItLgfvBEI0kMi1LgBRbV

Score

3^/10

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1640	4332	WerFault.exe	77
3132	4332	WerFault.exe	77
3536	4332	WerFault.exe	77

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4332	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 4332	2288	rundll32.exe	77
PID 2288 wrote to memory of 4332	2288	rundll32.exe	77
PID 2288 wrote to memory of 4332	2288	rundll32.exe	77

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e60bc161066dabea97cea12bd8559fa64884c7486108c1d09f83d97b84ce4fb4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e60bc161066dabea97cea12bd8559fa64884c7486108c1d09f83d97b84ce4fb4.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4332
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 848
    3⤵
    - Program crash
    PID:1640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 868
    3⤵
    - Program crash
    PID:3132
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 868
    3⤵
    - Program crash
    PID:3536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4332 -ip 4332
1⤵
PID:3668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4332 -ip 4332
1⤵
PID:392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4332 -ip 4332
1⤵
PID:3492

memory/4332-133-0x0000000010000000-0x0000000010324000-memory.dmp

Filesize
3.1MB

Download
memory/4332-134-0x0000000010000000-0x0000000010324000-memory.dmp

Filesize
3.1MB

Download
memory/4332-135-0x0000000010000000-0x0000000010324000-memory.dmp

Filesize
3.1MB

Download