3b508a21fa9d7bf87e481ff4e62799883f033341a54fdb45e9c6dd186dcec667

Analysis

max time kernel
215s
max time network
235s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/12/2023, 22:44

Target

fd9b5ba3c0ec1addb25e9ed90638b427.dll
Size

35KB
MD5

fd9b5ba3c0ec1addb25e9ed90638b427
SHA1

ad4533c81f1d495ea008a75693a927af2a2e241d
SHA256

3b508a21fa9d7bf87e481ff4e62799883f033341a54fdb45e9c6dd186dcec667
SHA512

b229d861e88a34b22590e89c213905393aece710366abce1938f2ada459cec49a500f4669c593bfad7ae79218a5052cf0ef9c715b010e7626ee5892705d07497
SSDEEP

768:ZgXwxTQzLfccFKJNCoPDqMugaTeHaenMgWUzPXdWyH+zOly3+I+zEui:ZggCzLUJfDtDNHacMgWU5WyH+0y3+lz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1628	2932	WerFault.exe	90

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2932	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2932	2736	rundll32.exe	90
PID 2736 wrote to memory of 2932	2736	rundll32.exe	90
PID 2736 wrote to memory of 2932	2736	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd9b5ba3c0ec1addb25e9ed90638b427.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd9b5ba3c0ec1addb25e9ed90638b427.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 616
    3⤵
    - Program crash
    PID:1628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2932 -ip 2932
1⤵
PID:1420