cb415d9cd7bdeca9181ad54b15f29e86e91184197696fd73d6e41ec2d2dd6b10

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 17:21

Target

cb415d9cd7bdeca9181ad54b15f29e86e91184197696fd73d6e41ec2d2dd6b10.dll
Size

4.4MB
MD5

5e8683eb92d7b945891bbb4b84a55ef5
SHA1

8d6cfd7576811f861700bd185abaa68548e732c4
SHA256

cb415d9cd7bdeca9181ad54b15f29e86e91184197696fd73d6e41ec2d2dd6b10
SHA512

f7fd0d865549759f77c856d1d2e409e1a0197bb587df38e61db68eb10ee5a8330f2e87319b3d7d87691e32445ea9203f463d18ba2c67a757e25aa1dbe1348682
SSDEEP

98304:9/E6evtnF4YC6wGVvg0RT1pzPVUv0YXKBBi21Ng700wm:98tBGF6ZvRrOP0Bi6g700w

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
3268	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4964	3268	WerFault.exe	82

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3268	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 3268	4592	rundll32.exe	82
PID 4592 wrote to memory of 3268	4592	rundll32.exe	82
PID 4592 wrote to memory of 3268	4592	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb415d9cd7bdeca9181ad54b15f29e86e91184197696fd73d6e41ec2d2dd6b10.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb415d9cd7bdeca9181ad54b15f29e86e91184197696fd73d6e41ec2d2dd6b10.dll,#1
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:3268
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3268 -s 1012
    3⤵
    - Program crash
    PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 3268 -ip 3268
1⤵
PID:840

C:\Users\Admin\AppData\Local\Temp\E2EECore.3.3.8.dll

Filesize
10.6MB

MD5
c1f7712711b59ed492ac4100cd76b8a1

SHA1
c548f1192890ebd924e5f47ccbfd4e607e322a36

SHA256
2f36f67c960644b5d53b24791b014c9758285256547f883b6db86cbeb734ef86

SHA512
682168ad42ad75e7c4a69e515636733c85a3380a260d681ceddff61f9d8529689307305e72b26406236439d9037e2e6be3ac53497c110f610710e830d4fedac7

Download Submit