030fd989d6fa4f51db433e7227d81885c230b40d446ee4c9f80f936ba68933f0

Analysis

max time kernel
127s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
31/08/2023, 21:31

Target

030fd989d6fa4f51db433e7227d81885c230b40d446ee4c9f80f936ba68933f0.dll
Size

1.2MB
MD5

a3cb9cec091a5acd0bf9e180ae48e59c
SHA1

35c5dfa1916e8a04e1b1d04171b2939a93704c48
SHA256

030fd989d6fa4f51db433e7227d81885c230b40d446ee4c9f80f936ba68933f0
SHA512

424de1ca13f2595b3d53b4bb56b4ca588a76c30e04aedfad4382d14222d972efb0c3b6abd0acd40fb3e4aa5cb5e0412cd120f9e903653f19c74a8544d36b704d
SSDEEP

24576:dyKg8uOS/RJqs6gZy72PvfEUdsxbYgzm1p93MCpU4w3dbSXDiBGHs8PD4KgXvFzh:d9S/Dqs6gZySXcKwbYgzm1p9R6bEzVM5

Score

3^/10

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2016	1628	WerFault.exe	82
548	1628	WerFault.exe	82
1920	1628	WerFault.exe	82

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1628	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 1628	3064	rundll32.exe	82
PID 3064 wrote to memory of 1628	3064	rundll32.exe	82
PID 3064 wrote to memory of 1628	3064	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\030fd989d6fa4f51db433e7227d81885c230b40d446ee4c9f80f936ba68933f0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\030fd989d6fa4f51db433e7227d81885c230b40d446ee4c9f80f936ba68933f0.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 864
    3⤵
    - Program crash
    PID:2016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 544
    3⤵
    - Program crash
    PID:548
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 880
    3⤵
    - Program crash
    PID:1920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1628 -ip 1628
1⤵
PID:2932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1628 -ip 1628
1⤵
PID:2908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1628 -ip 1628
1⤵
PID:1340