e52a969864cb6d9adb2ae857212e48adc77c39fda505410a25b763c590634c31

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 21:48

Target

1d89952c42262ecd51b4d9d6b4e965d2.dll
Size

56KB
MD5

1d89952c42262ecd51b4d9d6b4e965d2
SHA1

73948b9268390c81e63f4412b02087fb66a438ec
SHA256

e52a969864cb6d9adb2ae857212e48adc77c39fda505410a25b763c590634c31
SHA512

48f90523642cc4025376d202409990caebbd005d959de2e94023bd1a2ad2d09366e537f9c84e0c03886e9441c7f9b7565a22dd35109bce8f226b104e8bdaf61b
SSDEEP

768:kqhLvW4Nai0WEDNLhkdoMgdyWLbqE8/l188dCDe7w119:xWEai0WEh4gbLb38/zddn7wn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2072	2104	WerFault.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2104	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2104	2212	rundll32.exe	28
PID 2212 wrote to memory of 2104	2212	rundll32.exe	28
PID 2212 wrote to memory of 2104	2212	rundll32.exe	28
PID 2212 wrote to memory of 2104	2212	rundll32.exe	28
PID 2212 wrote to memory of 2104	2212	rundll32.exe	28
PID 2212 wrote to memory of 2104	2212	rundll32.exe	28
PID 2212 wrote to memory of 2104	2212	rundll32.exe	28
PID 2104 wrote to memory of 2072	2104	rundll32.exe	29
PID 2104 wrote to memory of 2072	2104	rundll32.exe	29
PID 2104 wrote to memory of 2072	2104	rundll32.exe	29
PID 2104 wrote to memory of 2072	2104	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d89952c42262ecd51b4d9d6b4e965d2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d89952c42262ecd51b4d9d6b4e965d2.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 264
    3⤵
    - Program crash
    PID:2072