c206c7ac04e9facb69a5e58a41586a828da4ac77b21dcd803b88549125358346

Analysis

max time kernel
135s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2023, 19:31

Target

c206c7ac04e9facb69a5e58a41586a828da4ac77b21dcd803b88549125358346.dll
Size

752KB
MD5

c0c8ab1dad6cafedd842b3521e7a6537
SHA1

ef3f44690958eb036a3844a946d979e38a19ea84
SHA256

c206c7ac04e9facb69a5e58a41586a828da4ac77b21dcd803b88549125358346
SHA512

c30316c69efb9acd050fbdca93e23f6eb04e25094c7d097ff0b3a916931b3d992034d32e911f6139ac1902b1745e08aaaae7df5eee1053ae88ce929ee2b4f93e
SSDEEP

12288:Zy5EXB6ABPJ5ixQNgyX0AvsIe+M9c1HJTgC6HptNCStBk1:ZycNJcxQNXTvVM92pUjRtBs

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4452	3620	WerFault.exe	81

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3620	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 3620	5068	rundll32.exe	81
PID 5068 wrote to memory of 3620	5068	rundll32.exe	81
PID 5068 wrote to memory of 3620	5068	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c206c7ac04e9facb69a5e58a41586a828da4ac77b21dcd803b88549125358346.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c206c7ac04e9facb69a5e58a41586a828da4ac77b21dcd803b88549125358346.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3620
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 700
    3⤵
    - Program crash
    PID:4452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3620 -ip 3620
1⤵
PID:4968