0b5ad207f3aeeb699ed22f247c84d8dbcb5b27af247e72bab13cebd6b96ebc99

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
22/09/2023, 05:15

Target

0b5ad207f3aeeb699ed22f247c84d8dbcb5b27af247e72bab13cebd6b96ebc99.dll
Size

5.3MB
MD5

328922ab1ab022453413be43c738a931
SHA1

442f5fa386252bdb47b25ec0324880d5236212ca
SHA256

0b5ad207f3aeeb699ed22f247c84d8dbcb5b27af247e72bab13cebd6b96ebc99
SHA512

e62e88399f025b1f6d88d5ed091a77af90a708ddb71a601a03c752139c7d4e2b98f8a6cece6c736c61d14a9402201aabf377064a7bb4350e01fafef5a74b9b52
SSDEEP

49152:gHQOgglgOSqLRwNPSRVFm7SmkQCHSaibEZDT+UYSTxEIDdABpljRW0a+aH7JxzSx:gHKPl4ax2nIEZTORQD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2320	4812	WerFault.exe	79

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4812	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 4812	1760	rundll32.exe	79
PID 1760 wrote to memory of 4812	1760	rundll32.exe	79
PID 1760 wrote to memory of 4812	1760	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b5ad207f3aeeb699ed22f247c84d8dbcb5b27af247e72bab13cebd6b96ebc99.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b5ad207f3aeeb699ed22f247c84d8dbcb5b27af247e72bab13cebd6b96ebc99.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4812
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 684
    3⤵
    - Program crash
    PID:2320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4812 -ip 4812
1⤵
PID:2872

memory/4812-0-0x0000000074740000-0x0000000074CB4000-memory.dmp

Filesize
5.5MB

Download