f84d4164599ea7dceaed35e1e0f83c47cc28a450075f08c913708409d692424c

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 20:44

Target

f84d4164599ea7dceaed35e1e0f83c47cc28a450075f08c913708409d692424c.dll
Size

967KB
MD5

2eca1b7488886ec0ec754830f1321aae
SHA1

2fe85a33aca331f587c9477c77529bace9f32282
SHA256

f84d4164599ea7dceaed35e1e0f83c47cc28a450075f08c913708409d692424c
SHA512

e8dc7c47b6d781ed4efa3cadfa109f6bd11cc03b448c97d1f056e8d818065f2557fb38c42336f848f4e85c60d92a06ddefe405be15c00f8337d45bb5b49bd676
SSDEEP

24576:eEJ0SAAmRiQSo3tadofUxABGdqYczqrZ4dxxUV2tPqXX:B0SAAmRiFU8dofUuGdqYczqrZyxCCC

Score

6^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1820	1228	WerFault.exe	84

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5092 set thread context of 1228	5092	rundll32.exe	84

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1228	iexplore.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 5092	4984	rundll32.exe	83
PID 4984 wrote to memory of 5092	4984	rundll32.exe	83
PID 4984 wrote to memory of 5092	4984	rundll32.exe	83
PID 5092 wrote to memory of 1228	5092	rundll32.exe	84
PID 5092 wrote to memory of 1228	5092	rundll32.exe	84
PID 5092 wrote to memory of 1228	5092	rundll32.exe	84
PID 5092 wrote to memory of 1228	5092	rundll32.exe	84
PID 5092 wrote to memory of 1228	5092	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f84d4164599ea7dceaed35e1e0f83c47cc28a450075f08c913708409d692424c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f84d4164599ea7dceaed35e1e0f83c47cc28a450075f08c913708409d692424c.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1228
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 1236
      4⤵
      Program crash
      PID:1820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1228 -ip 1228
1⤵
PID:804

memory/5092-133-0x0000000000AB0000-0x0000000000BA6000-memory.dmp

Filesize
984KB

Download