2278026ebff5df923bb074305062a16e886a79a93ee0b1f73f60a482e1ebd30e

Analysis

max time kernel
92s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
16-02-2023 20:54

Target

2278026ebff5df923bb074305062a16e886a79a93ee0b1f73f60a482e1ebd30e.dll
Size

1006KB
MD5

ca83768a634ca137bed49f7cb4cc1ee8
SHA1

aa9b204d1efcffe12dc10ec596299bf18b90064a
SHA256

2278026ebff5df923bb074305062a16e886a79a93ee0b1f73f60a482e1ebd30e
SHA512

d307468d09c14a714e62902519376e11d75f32f7f86034d108edd3682f08d692aa6b7750a6f8a3efa5c51a072d2f7eba57bb6756a7693912e5f33663446aa7c6
SSDEEP

24576:XnXzw0eNlVIj5Auqy8ixlMKOJLKEmC0RDUSIdE9iS:XncjyGjy8xbJlmZvQE9f

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4888 1000 WerFault.exe rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1000 rundll32.exe

pid	pid_target	process	target process
4888	1000	WerFault.exe	rundll32.exe

pid	process
1000	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2420 wrote to memory of 1000	2420	rundll32.exe	rundll32.exe
PID 2420 wrote to memory of 1000	2420	rundll32.exe	rundll32.exe
PID 2420 wrote to memory of 1000	2420	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2278026ebff5df923bb074305062a16e886a79a93ee0b1f73f60a482e1ebd30e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2278026ebff5df923bb074305062a16e886a79a93ee0b1f73f60a482e1ebd30e.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 780
    3⤵
    - Program crash
    PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1000 -ip 1000
1⤵
PID:1696

memory/1000-132-0x0000000000000000-mapping.dmp

Download
memory/1000-133-0x0000000000400000-0x0000000000771000-memory.dmp

Filesize
3.4MB

Download
memory/1000-134-0x0000000000400000-0x0000000000771000-memory.dmp

Filesize
3.4MB

Download
memory/1000-135-0x0000000000400000-0x0000000000771000-memory.dmp

Filesize
3.4MB

Download
memory/1000-136-0x0000000000400000-0x0000000000771000-memory.dmp

Filesize
3.4MB

Download
memory/1000-137-0x0000000000400000-0x0000000000771000-memory.dmp

Filesize
3.4MB

Download
memory/1000-138-0x0000000000400000-0x0000000000771000-memory.dmp

Filesize
3.4MB

Download