21acdf5616dd7c67e4039eec9d981a78b9cea077dfadff4e290dbea2c3e24537

Analysis

max time kernel
75s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2023 19:41

Target

21acdf5616dd7c67e4039eec9d981a78b9cea077dfadff4e290dbea2c3e24537.exe
Size

4.6MB
MD5

ed065e03d90812f4f2191944cabaa193
SHA1

45940d71ce3730fe00cd172901a2867623bc0a9d
SHA256

21acdf5616dd7c67e4039eec9d981a78b9cea077dfadff4e290dbea2c3e24537
SHA512

b6b7448a8a0b531d094a48c3f86a140eab93556427e51baa16768440c1fe5c6741f35204b98704aa5ca9f02ff8becac2b3d1128a077ce85f392557be3757ba13
SSDEEP

49152:PB8+oa6bXQn04bHXuPugPnTBVuscOjZ7wG2VXVscK0oKdTH4AUKyYTIiBS4Yy9hH:J7b3uPuGjZEGs6uipUTYy927HM9GWFj

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2800	21acdf5616dd7c67e4039eec9d981a78b9cea077dfadff4e290dbea2c3e24537.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\rwtzid.dll	21acdf5616dd7c67e4039eec9d981a78b9cea077dfadff4e290dbea2c3e24537.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3212	2800	WerFault.exe	82

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2800	21acdf5616dd7c67e4039eec9d981a78b9cea077dfadff4e290dbea2c3e24537.exe
2800	21acdf5616dd7c67e4039eec9d981a78b9cea077dfadff4e290dbea2c3e24537.exe
2800	21acdf5616dd7c67e4039eec9d981a78b9cea077dfadff4e290dbea2c3e24537.exe

C:\Users\Admin\AppData\Local\Temp\21acdf5616dd7c67e4039eec9d981a78b9cea077dfadff4e290dbea2c3e24537.exe
"C:\Users\Admin\AppData\Local\Temp\21acdf5616dd7c67e4039eec9d981a78b9cea077dfadff4e290dbea2c3e24537.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 1652
  2⤵
  - Program crash
  PID:3212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2800 -ip 2800
1⤵
PID:4716

C:\Windows\Fonts\rwtzid.dll

Filesize
1004KB

MD5
1938bc501c2cbaacdd8e4a1fe4441b53

SHA1
7894d0d1f00d8293913392601fc8af07015f4945

SHA256
57252baf752a552e600a7a86d0040c44822de3b3fe7ca42f873501bb643e92fe

SHA512
b8ddd2d3e5df03683de540fdb720dca47c545e1877727474559576664d226b0c2dc713f6afb98b95f1150bb2ac8f65d33b3446530d2c9cc8fe0b0ecf25380212

Download Submit