1dca91cb7cc387cc708dd058bd12a300fafac08ede939c2f696e576e19273cc5

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2023, 06:22

Target

1dca91cb7cc387cc708dd058bd12a300fafac08ede939c2f696e576e19273cc5.dll
Size

5.2MB
MD5

d1f02b842a2436bb5d8e94751d098d4f
SHA1

4edc5d6b32cde8fc6a36a2ff3e392347219837ee
SHA256

1dca91cb7cc387cc708dd058bd12a300fafac08ede939c2f696e576e19273cc5
SHA512

b8105e6aec35f0b39c86a636c6e8d589f66249fe1f95afaa8f0847044650770de62ace28f403be40108414ae4205275b21bc3f9f33fef92729977f1cd947b7f9
SSDEEP

49152:ou8tUDv8sODg7qwYZIzGEdbX7FpfSwPIPoCzKCcF:smDv8DsewYZIzGY7LfSwPIPoQN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4508	4784	WerFault.exe	82

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4784	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 4784	4044	rundll32.exe	82
PID 4044 wrote to memory of 4784	4044	rundll32.exe	82
PID 4044 wrote to memory of 4784	4044	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1dca91cb7cc387cc708dd058bd12a300fafac08ede939c2f696e576e19273cc5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1dca91cb7cc387cc708dd058bd12a300fafac08ede939c2f696e576e19273cc5.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 792
    3⤵
    - Program crash
    PID:4508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4784 -ip 4784
1⤵
PID:1416