1dff3dbd92a472008a5b1327b5ddb58c949add26dc56214cade8507844935e34

Analysis

max time kernel
84s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2023, 21:47

Target

1dff3dbd92a472008a5b1327b5ddb58c949add26dc56214cade8507844935e34.dll
Size

10.0MB
MD5

4dc9f888a5f67142a1c8a8cf4839997b
SHA1

aa6e2dd5b7138287983230bd54ba2b994ad41391
SHA256

1dff3dbd92a472008a5b1327b5ddb58c949add26dc56214cade8507844935e34
SHA512

b3b140c7ebe6a822086b7a3221a79fff12f5a92a3539aeb4c14695ac18b612ba64bcf23a9f09e6934763f5cb2458a2a65408d41f5ca778ad0695bd50aef8e123
SSDEEP

196608:navcXGnk3zdMec3zdMeHtfd8tM2ijOtOfW:WXQMeIMeHt132

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4324	112	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
112	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 112	4352	rundll32.exe	81
PID 4352 wrote to memory of 112	4352	rundll32.exe	81
PID 4352 wrote to memory of 112	4352	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1dff3dbd92a472008a5b1327b5ddb58c949add26dc56214cade8507844935e34.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1dff3dbd92a472008a5b1327b5ddb58c949add26dc56214cade8507844935e34.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 112 -s 696
    3⤵
    - Program crash
    PID:4324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 112 -ip 112
1⤵
PID:420