353d8dc211e089976f90a77fe02fcd94622c3f454d1cd03c3fc8e76ab979f48f

Analysis

max time kernel
90s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2023, 02:48

Target

353d8dc211e089976f90a77fe02fcd94622c3f454d1cd03c3fc8e76ab979f48f.dll
Size

1.2MB
MD5

c55c83a22e724335ff9f07259f285a3d
SHA1

abee3d56d60321d7a8232147ddf9d52479e8f4b2
SHA256

353d8dc211e089976f90a77fe02fcd94622c3f454d1cd03c3fc8e76ab979f48f
SHA512

1d4f78e94e8321b89c33d2cf847ce5e082fc75af4d56565d61e6724caa60fada37689ebc9c0831226475d7fa7f6bb4fe648e096ff76f06f6f5349895369e1575
SSDEEP

24576:cziOpKxxem35DKBP2r4YmF+cau6r4iKymwCZj752McQLW5OSb4e:cA48KTYmIcbZcD5OSUe

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4872	4896	WerFault.exe	80

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4896	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 4896	1652	rundll32.exe	80
PID 1652 wrote to memory of 4896	1652	rundll32.exe	80
PID 1652 wrote to memory of 4896	1652	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\353d8dc211e089976f90a77fe02fcd94622c3f454d1cd03c3fc8e76ab979f48f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\353d8dc211e089976f90a77fe02fcd94622c3f454d1cd03c3fc8e76ab979f48f.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 692
    3⤵
    - Program crash
    PID:4872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4896 -ip 4896
1⤵
PID:4800