61b0b6148dfb82f659edc51f0326f1ffe6db91548dceab0c05add0c5d78ab894

Analysis

max time kernel
97s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
17-02-2023 20:07

Target

61b0b6148dfb82f659edc51f0326f1ffe6db91548dceab0c05add0c5d78ab894.dll
Size

1.2MB
MD5

666688dcbd999a4cf67ed3e29031b37d
SHA1

836dd9f7ddfbd2ee3f6856148ff12169ff648951
SHA256

61b0b6148dfb82f659edc51f0326f1ffe6db91548dceab0c05add0c5d78ab894
SHA512

f649c5531691f57560fe3e0cc7c05d8b95109dbacd7d164bf0d358856ff624a4c873a6bf62ea1f19753837f86f35b8d5dd76a399d91e6f3e64c1c93c11a9b8a6
SSDEEP

24576:xBDiyoaT8a0icpELVbcxiVkGf6yI4EeBDa3oU5G3isrBLTGv7IXkKhCw9gNmiME:nonULaxivf6yIf5Gp9GjIXkKs5mB

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

816 948 WerFault.exe rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

948 rundll32.exe

pid	pid_target	process	target process
816	948	WerFault.exe	rundll32.exe

pid	process
948	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1208 wrote to memory of 948	1208	rundll32.exe	rundll32.exe
PID 1208 wrote to memory of 948	1208	rundll32.exe	rundll32.exe
PID 1208 wrote to memory of 948	1208	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\61b0b6148dfb82f659edc51f0326f1ffe6db91548dceab0c05add0c5d78ab894.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\61b0b6148dfb82f659edc51f0326f1ffe6db91548dceab0c05add0c5d78ab894.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 760
    3⤵
    - Program crash
    PID:816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 948 -ip 948
1⤵
PID:2876

memory/948-132-0x0000000000000000-mapping.dmp

Download
memory/948-134-0x00000000022F0000-0x00000000026C8000-memory.dmp

Filesize
3.8MB

Download
memory/948-133-0x00000000022F0000-0x00000000026C8000-memory.dmp

Filesize
3.8MB

Download
memory/948-136-0x00000000022F0000-0x00000000026C8000-memory.dmp

Filesize
3.8MB

Download
memory/948-137-0x00000000022F0000-0x00000000026C8000-memory.dmp

Filesize
3.8MB

Download
memory/948-138-0x00000000022F0000-0x00000000026C8000-memory.dmp

Filesize
3.8MB

Download
memory/948-139-0x00000000022F0000-0x00000000026C8000-memory.dmp

Filesize
3.8MB

Download