dd4ba8abe88f4a2a3f9eccc64f0e22fc77b341c750604618cccd93c8c9cbba28

Analysis

max time kernel
148s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 14:31

Target

0115ca9901e35dd33226f76587175f9a.dll
Size

173KB
MD5

0115ca9901e35dd33226f76587175f9a
SHA1

674da62b274681e8d71a7b70994d8fef993643a4
SHA256

dd4ba8abe88f4a2a3f9eccc64f0e22fc77b341c750604618cccd93c8c9cbba28
SHA512

69ec23e843f43ceb13e8210a4cf0121791ccebce466d79b68b432f41bc7d54c0e518ca3584cc149151d2cbc1b710b454a6b2642cbb0d0f58b76628736a82407e
SSDEEP

3072:7OT05oZPGSw632OjXIqR/GgMoaHFTw0CSkTTqQ4jU7JM3D743N1:iTeRSzVDNkk0vkfqQet6N1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4236	3520	WerFault.exe	15

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3520	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 3520	2684	rundll32.exe	15
PID 2684 wrote to memory of 3520	2684	rundll32.exe	15
PID 2684 wrote to memory of 3520	2684	rundll32.exe	15

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0115ca9901e35dd33226f76587175f9a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0115ca9901e35dd33226f76587175f9a.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3520
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 608
    3⤵
    - Program crash
    PID:4236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3520 -ip 3520
1⤵
PID:1072