20fd24c9ac1ed19bf2dc37f7de0d2cd9327b4c6dfce1dcba302acaa53d9c136f

Analysis

max time kernel
72s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
31-03-2023 04:51

Target

20fd24c9ac1ed19bf2dc37f7de0d2cd9327b4c6dfce1dcba302acaa53d9c136f.dll
Size

406KB
MD5

f2ec4d3ecc14b503d8b7d0bbeff709da
SHA1

63695a83d5ec89a9f1bed135d8db8e4b9f1cfe23
SHA256

20fd24c9ac1ed19bf2dc37f7de0d2cd9327b4c6dfce1dcba302acaa53d9c136f
SHA512

f497841b6ab15cb2645de9a771580ca6ded2edc35d692cee608ff39f15d464012616fa6caf3e302c09797d3a8325ed7ef00a52470b578af2b72d3ff6d758787c
SSDEEP

6144:gg86sZbdQ9SFGv78Ck5WAmOohb35RuFFxDH319FO5QCHmMg78l4C998UZ7OYDcOy:EbDFGv+RohbpM/xDH319FcaC9dDcO

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1536 3728 WerFault.exe rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

3728 rundll32.exe

pid	pid_target	process	target process
1536	3728	WerFault.exe	rundll32.exe

pid	process
3728	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1520 wrote to memory of 3728	1520	rundll32.exe	rundll32.exe
PID 1520 wrote to memory of 3728	1520	rundll32.exe	rundll32.exe
PID 1520 wrote to memory of 3728	1520	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\20fd24c9ac1ed19bf2dc37f7de0d2cd9327b4c6dfce1dcba302acaa53d9c136f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1520

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\20fd24c9ac1ed19bf2dc37f7de0d2cd9327b4c6dfce1dcba302acaa53d9c136f.dll,#1
2⤵
- Suspicious use of SetWindowsHookEx
PID:3728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3728 -s 692
3⤵
- Program crash
PID:1536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3728 -ip 3728
1⤵
PID:4456

memory/3728-133-0x0000000010000000-0x00000000100FF000-memory.dmp

Filesize
1020KB

Download
memory/3728-135-0x0000000010000000-0x00000000100FF000-memory.dmp

Filesize
1020KB

Download
memory/3728-134-0x0000000010000000-0x00000000100FF000-memory.dmp

Filesize
1020KB

Download
memory/3728-136-0x0000000010000000-0x00000000100FF000-memory.dmp

Filesize
1020KB

Download