9ccd705289020653e333c408e37b7b44c73bc4ee56ca128b344b9d95f48aa22d

Analysis

max time kernel
136s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2023, 21:45

Target

9ccd705289020653e333c408e37b7b44c73bc4ee56ca128b344b9d95f48aa22d.dll
Size

5.3MB
MD5

7662489b2216c9b5d3efc395a22d9c10
SHA1

a76829e9c7d2558c39705ef50d5d2a877f16d0b2
SHA256

9ccd705289020653e333c408e37b7b44c73bc4ee56ca128b344b9d95f48aa22d
SHA512

493691be8910b8ccf45c7a1cf745d2206426fbc0626fd68b9b2f4f4510688327d22b5a897587326d76201f7a94c6748272d5cc176b91cd019542fbae38d71d1f
SSDEEP

49152:fqQO5gl4W3RzpJNPSJtFuzSu0QCHqKq7NhDT+8Ylrqco+dgBpJNCW5a+aH7Jxz2x:fq/3k/XB2fgNKryCXD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4372	4868	WerFault.exe	84

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4868	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 4868	1816	rundll32.exe	84
PID 1816 wrote to memory of 4868	1816	rundll32.exe	84
PID 1816 wrote to memory of 4868	1816	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ccd705289020653e333c408e37b7b44c73bc4ee56ca128b344b9d95f48aa22d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ccd705289020653e333c408e37b7b44c73bc4ee56ca128b344b9d95f48aa22d.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 684
    3⤵
    - Program crash
    PID:4372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4868 -ip 4868
1⤵
PID:2068

memory/4868-0-0x0000000074950000-0x0000000074EC4000-memory.dmp

Filesize
5.5MB

Download