cbe204430259846c4931bc787d52efcc8069492e43f21895775e4f006b50024a

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
15/11/2023, 10:03

Target

cbe204430259846c4931bc787d52efcc8069492e43f21895775e4f006b50024a.dll
Size

1.0MB
MD5

6b412fa527f67d8aa932077815040485
SHA1

506947dc3ed75e99d763ee21181680f84fc956c3
SHA256

cbe204430259846c4931bc787d52efcc8069492e43f21895775e4f006b50024a
SHA512

eec48c1906b84d3a38b3aebaa37c4ab0b7a8c4696af9b815f8c13b8c3915dc59687afbb28ef88656e2f2ee4ac0af48b3aa27248acd26b000f26f29826b77f5a4
SSDEEP

24576:wprBKEy/IBkoECXwVVBdDlz1DFVox4b8D:bEyABhChDV1DFVo7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2676	2968	WerFault.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2968	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2968	2508	rundll32.exe	28
PID 2508 wrote to memory of 2968	2508	rundll32.exe	28
PID 2508 wrote to memory of 2968	2508	rundll32.exe	28
PID 2508 wrote to memory of 2968	2508	rundll32.exe	28
PID 2508 wrote to memory of 2968	2508	rundll32.exe	28
PID 2508 wrote to memory of 2968	2508	rundll32.exe	28
PID 2508 wrote to memory of 2968	2508	rundll32.exe	28
PID 2968 wrote to memory of 2676	2968	rundll32.exe	29
PID 2968 wrote to memory of 2676	2968	rundll32.exe	29
PID 2968 wrote to memory of 2676	2968	rundll32.exe	29
PID 2968 wrote to memory of 2676	2968	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbe204430259846c4931bc787d52efcc8069492e43f21895775e4f006b50024a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbe204430259846c4931bc787d52efcc8069492e43f21895775e4f006b50024a.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 312
    3⤵
    - Program crash
    PID:2676

memory/2968-0-0x0000000010000000-0x000000001013D000-memory.dmp

Filesize
1.2MB

Download
memory/2968-1-0x0000000010000000-0x000000001013D000-memory.dmp

Filesize
1.2MB

Download
memory/2968-2-0x0000000010000000-0x000000001013D000-memory.dmp

Filesize
1.2MB

Download