4ed25ed6ed0a2e582099acf3218ccf10a8c1a7cf848c229ccce8ee02ab896446

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 09:23

Target

63791ff2a9d86c9f145c27754b4161e2.dll
Size

428KB
MD5

63791ff2a9d86c9f145c27754b4161e2
SHA1

5eb36555d0aa444a5577fb1e02529c0971ea1a63
SHA256

4ed25ed6ed0a2e582099acf3218ccf10a8c1a7cf848c229ccce8ee02ab896446
SHA512

8aec2f7868f91454e865c071c11c515d866dc2af6cdfe9498a4f03003e7301b33a56c20b853dded7eaa7067ba753665c7038d8f0ccc402c2388b0f1bc58cee7b
SSDEEP

12288:hJzvJ2xSVhbARCSdkSSy47J5NmxX0+NRCb2C:hJzvJ2x7CCSh/7CC

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4524	4724	WerFault.exe	87
860	4724	WerFault.exe	87

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4724	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 208 wrote to memory of 4724	208	rundll32.exe	87
PID 208 wrote to memory of 4724	208	rundll32.exe	87
PID 208 wrote to memory of 4724	208	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\63791ff2a9d86c9f145c27754b4161e2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\63791ff2a9d86c9f145c27754b4161e2.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4724
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 592
    3⤵
    - Program crash
    PID:4524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 592
    3⤵
    - Program crash
    PID:860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4724 -ip 4724
1⤵
PID:4876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4724 -ip 4724
1⤵
PID:4772

memory/4724-0-0x0000000000400000-0x0000000000534000-memory.dmp

Filesize
1.2MB

Download
memory/4724-1-0x0000000002860000-0x0000000002861000-memory.dmp

Filesize
4KB

Download
memory/4724-2-0x0000000000400000-0x0000000000534000-memory.dmp

Filesize
1.2MB

Download