f9b4b2c09c029d38ab24cbb94e35a5b5f3cfc6ccbb727a8ac03b0ffe54f99074

Analysis

max time kernel
119s
max time network
135s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 23:51

Target

f9b4b2c09c029d38ab24cbb94e35a5b5f3cfc6ccbb727a8ac03b0ffe54f99074.dll
Size

790KB
MD5

a94793e70e4f61f3eacd8ca52232130a
SHA1

8bf821cc67ea714cdc2b3b3c53587adb3b4d92d2
SHA256

f9b4b2c09c029d38ab24cbb94e35a5b5f3cfc6ccbb727a8ac03b0ffe54f99074
SHA512

92368d1338eff814c8157f72e33493b02e9c95b3303caac4dd24233bcd50cb3b967014019c1c780e13358655c5abf30de4a73dd284e0af20fd5876a2dda163ed
SSDEEP

6144:JjegBXXdQ2TLnOK7FVuquT9LPqAXuzsMQMRY5VTc4txmGZewW1xaLbJfYi5eZwQk:JBLHnOK7PoUIM8wSmGQwUGgiflVyI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2984	1720	WerFault.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1720	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 1720	2544	rundll32.exe	28
PID 2544 wrote to memory of 1720	2544	rundll32.exe	28
PID 2544 wrote to memory of 1720	2544	rundll32.exe	28
PID 2544 wrote to memory of 1720	2544	rundll32.exe	28
PID 2544 wrote to memory of 1720	2544	rundll32.exe	28
PID 2544 wrote to memory of 1720	2544	rundll32.exe	28
PID 2544 wrote to memory of 1720	2544	rundll32.exe	28
PID 1720 wrote to memory of 2984	1720	rundll32.exe	29
PID 1720 wrote to memory of 2984	1720	rundll32.exe	29
PID 1720 wrote to memory of 2984	1720	rundll32.exe	29
PID 1720 wrote to memory of 2984	1720	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9b4b2c09c029d38ab24cbb94e35a5b5f3cfc6ccbb727a8ac03b0ffe54f99074.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9b4b2c09c029d38ab24cbb94e35a5b5f3cfc6ccbb727a8ac03b0ffe54f99074.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 272
    3⤵
    - Program crash
    PID:2984