27d56ff8547d6a2e93c0044f57d5c2d77ab7159becd12ac2a273c0b9c49f7848

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2023, 22:38

Target

27d56ff8547d6a2e93c0044f57d5c2d77ab7159becd12ac2a273c0b9c49f7848.dll
Size

9.7MB
MD5

0b8bee90f401a332e26d15e88f70e7dd
SHA1

e6a39810b738294c9bcc2249a29ae91445f1390f
SHA256

27d56ff8547d6a2e93c0044f57d5c2d77ab7159becd12ac2a273c0b9c49f7848
SHA512

029fa6a81ba5103166cf3363804c9849520fee83247bd8596142d4da6b7816737d64d43f68744a4cfc6ce64a5ebe6998b964f4d4d1f2de75cd66a656b9fa25b9
SSDEEP

98304:uYmMCex+NVo8YMlg6/nO3AJLWypd9NXfeBnc69v0vMru22Z7aefEflQiYrYVo0j3:ypcXGnbLWU98tfd8tM2ik0vju3J8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4504	4268	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4268	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 4268	1196	rundll32.exe	81
PID 1196 wrote to memory of 4268	1196	rundll32.exe	81
PID 1196 wrote to memory of 4268	1196	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\27d56ff8547d6a2e93c0044f57d5c2d77ab7159becd12ac2a273c0b9c49f7848.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\27d56ff8547d6a2e93c0044f57d5c2d77ab7159becd12ac2a273c0b9c49f7848.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4268
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 696
    3⤵
    - Program crash
    PID:4504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4268 -ip 4268
1⤵
PID:1216