1dff3dbd92a472008a5b1327b5ddb58c949add26dc56214cade8507844935e34

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
26/08/2023, 21:47

Target

1dff3dbd92a472008a5b1327b5ddb58c949add26dc56214cade8507844935e34.dll
Size

10.0MB
MD5

4dc9f888a5f67142a1c8a8cf4839997b
SHA1

aa6e2dd5b7138287983230bd54ba2b994ad41391
SHA256

1dff3dbd92a472008a5b1327b5ddb58c949add26dc56214cade8507844935e34
SHA512

b3b140c7ebe6a822086b7a3221a79fff12f5a92a3539aeb4c14695ac18b612ba64bcf23a9f09e6934763f5cb2458a2a65408d41f5ca778ad0695bd50aef8e123
SSDEEP

196608:navcXGnk3zdMec3zdMeHtfd8tM2ijOtOfW:WXQMeIMeHt132

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2192	1796	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1796	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 1796	1660	rundll32.exe	28
PID 1660 wrote to memory of 1796	1660	rundll32.exe	28
PID 1660 wrote to memory of 1796	1660	rundll32.exe	28
PID 1660 wrote to memory of 1796	1660	rundll32.exe	28
PID 1660 wrote to memory of 1796	1660	rundll32.exe	28
PID 1660 wrote to memory of 1796	1660	rundll32.exe	28
PID 1660 wrote to memory of 1796	1660	rundll32.exe	28
PID 1796 wrote to memory of 2192	1796	rundll32.exe	29
PID 1796 wrote to memory of 2192	1796	rundll32.exe	29
PID 1796 wrote to memory of 2192	1796	rundll32.exe	29
PID 1796 wrote to memory of 2192	1796	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1dff3dbd92a472008a5b1327b5ddb58c949add26dc56214cade8507844935e34.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1dff3dbd92a472008a5b1327b5ddb58c949add26dc56214cade8507844935e34.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1796
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 276
    3⤵
    - Program crash
    PID:2192