95c12c62db0c5efb79671a73f7c05e16e94efbe855077de32fb0018d9a3ba65d

Analysis

max time kernel
150s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
22/09/2023, 07:57

Target

95c12c62db0c5efb79671a73f7c05e16e94efbe855077de32fb0018d9a3ba65d.dll
Size

3.3MB
MD5

d2c1d4db6f10fa71beaf7c855969d394
SHA1

ca6aeee30b1e8a31d52c6b18ae3eb4849d52aff1
SHA256

95c12c62db0c5efb79671a73f7c05e16e94efbe855077de32fb0018d9a3ba65d
SHA512

ec5913c805208546eccc351e1f47233c00ed0726360f4fb7f8e280eb889bd0f65efd81f7827980e91209c3990b73cf42bcb692709dc6626c0c3c0074ec73e0fd
SSDEEP

98304:15kUL70XD4Of7ui/Z8RW4mVPi+fnbFczI:TwX006i/pVKCbFczI

Score

3^/10

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2472	3240	WerFault.exe	84
4524	3240	WerFault.exe	84
2192	3240	WerFault.exe	84

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3240	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3776 wrote to memory of 3240	3776	rundll32.exe	84
PID 3776 wrote to memory of 3240	3776	rundll32.exe	84
PID 3776 wrote to memory of 3240	3776	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\95c12c62db0c5efb79671a73f7c05e16e94efbe855077de32fb0018d9a3ba65d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\95c12c62db0c5efb79671a73f7c05e16e94efbe855077de32fb0018d9a3ba65d.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3240
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 812
    3⤵
    - Program crash
    PID:2472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 828
    3⤵
    - Program crash
    PID:4524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 824
    3⤵
    - Program crash
    PID:2192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3240 -ip 3240
1⤵
PID:2460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3240 -ip 3240
1⤵
PID:4480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3240 -ip 3240
1⤵
PID:2232

memory/3240-0-0x0000000010000000-0x00000000107B0000-memory.dmp

Filesize
7.7MB

Download
memory/3240-1-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Filesize
4KB

Download
memory/3240-2-0x0000000010000000-0x00000000107B0000-memory.dmp

Filesize
7.7MB

Download
memory/3240-3-0x0000000010000000-0x00000000107B0000-memory.dmp

Filesize
7.7MB

Download