3b711cbe7435999e170f12d098d33691ce8f61e75a4d0b827354aa60203d37d7

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
16-08-2023 04:06

Target

3b711cbe7435999e170f12d098d33691ce8f61e75a4d0b827354aa60203d37d7.dll
Size

980KB
MD5

f365c64a70084d02d6081e560bfbb2e0
SHA1

25903b991766e8a7add7d83dea9832a9daba4242
SHA256

3b711cbe7435999e170f12d098d33691ce8f61e75a4d0b827354aa60203d37d7
SHA512

afb2f1a3c7bf65fa4ed9bd586984477e3e46ee47d4fcce56644c4327f92d090a814eb4d23f52d1da85c4f9e90deb36b1f384eb3da20afcb844383b5b1330f2db
SSDEEP

24576:bOh97EhFtu+0Rk5zkFicPUkAYmST5IJKkQWtS5Zkn:biiKmSJfy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4596	5004	WerFault.exe	82

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5004	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 5004	2740	rundll32.exe	82
PID 2740 wrote to memory of 5004	2740	rundll32.exe	82
PID 2740 wrote to memory of 5004	2740	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b711cbe7435999e170f12d098d33691ce8f61e75a4d0b827354aa60203d37d7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b711cbe7435999e170f12d098d33691ce8f61e75a4d0b827354aa60203d37d7.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 692
    3⤵
    - Program crash
    PID:4596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5004 -ip 5004
1⤵
PID:4360