7012a0939e308262ff94fff276606747ded8b331cbc0cef19a226a550a1770a8

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 03:26

Target

7012a0939e308262ff94fff276606747ded8b331cbc0cef19a226a550a1770a8.dll
Size

138KB
MD5

9663ea12d97499ce02f483f1ff0fab4b
SHA1

9212c5da8d0cb536f69d498ee05d3b1279c7c60f
SHA256

7012a0939e308262ff94fff276606747ded8b331cbc0cef19a226a550a1770a8
SHA512

9d4ff68b646335ab5542913f0175b8216cc6ee4b0e593a0994a4949e3c6ffea20e6213e46dca28bdc794963993824d12993bb6100293aa445100b25fbb4a9564
SSDEEP

3072:72rPQ7Bu/KlMMgSnh6HgweScPabmlIMi7CEE:KzgvhwgpJPaKYCE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5048	4908	WerFault.exe	79

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4908	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 4908	2636	rundll32.exe	79
PID 2636 wrote to memory of 4908	2636	rundll32.exe	79
PID 2636 wrote to memory of 4908	2636	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7012a0939e308262ff94fff276606747ded8b331cbc0cef19a226a550a1770a8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7012a0939e308262ff94fff276606747ded8b331cbc0cef19a226a550a1770a8.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 632
    3⤵
    - Program crash
    PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4908 -ip 4908
1⤵
PID:732