cd6f6f6f280686ba810926ec36c4717ac8a48cc718f575cbf78bce91671871e1

Analysis

max time kernel
158s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 08:19

Target

cd6f6f6f280686ba810926ec36c4717ac8a48cc718f575cbf78bce91671871e1.dll
Size

1.2MB
MD5

c7c5a4eb5b3decbbb9c0acb9957c634a
SHA1

611e62b2baf00aebcf115b9f62f272d69569b9b6
SHA256

cd6f6f6f280686ba810926ec36c4717ac8a48cc718f575cbf78bce91671871e1
SHA512

98ecd1ac701c5e7d14817b5e931327ae382aec7702b194f0724f218058776464b0d6a22b19ecba92b17ab57ce762396ad73353ff2c4e79319d99d2b8298209ea
SSDEEP

12288:/O24+UyJJvTGyjXbxobwk3rjmS6ROS1vwlgwM3tzJBaHvuGG3STaUTC9KGSu+aIv:/RDRQYpxTVx2UKo6HgBI6rK/

Score

3^/10

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2376	1656	WerFault.exe	85
2908	1656	WerFault.exe	85
3616	1656	WerFault.exe	85

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1656	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 1656	2528	rundll32.exe	85
PID 2528 wrote to memory of 1656	2528	rundll32.exe	85
PID 2528 wrote to memory of 1656	2528	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cd6f6f6f280686ba810926ec36c4717ac8a48cc718f575cbf78bce91671871e1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cd6f6f6f280686ba810926ec36c4717ac8a48cc718f575cbf78bce91671871e1.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 740
    3⤵
    - Program crash
    PID:2376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 624
    3⤵
    - Program crash
    PID:2908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 656
    3⤵
    - Program crash
    PID:3616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1656 -ip 1656
1⤵
PID:1224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1656 -ip 1656
1⤵
PID:2288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1656 -ip 1656
1⤵
PID:4904

memory/1656-0-0x0000000010000000-0x0000000010160000-memory.dmp

Filesize
1.4MB

Download