e52a969864cb6d9adb2ae857212e48adc77c39fda505410a25b763c590634c31

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 21:48

Target

1d89952c42262ecd51b4d9d6b4e965d2.dll
Size

56KB
MD5

1d89952c42262ecd51b4d9d6b4e965d2
SHA1

73948b9268390c81e63f4412b02087fb66a438ec
SHA256

e52a969864cb6d9adb2ae857212e48adc77c39fda505410a25b763c590634c31
SHA512

48f90523642cc4025376d202409990caebbd005d959de2e94023bd1a2ad2d09366e537f9c84e0c03886e9441c7f9b7565a22dd35109bce8f226b104e8bdaf61b
SSDEEP

768:kqhLvW4Nai0WEDNLhkdoMgdyWLbqE8/l188dCDe7w119:xWEai0WEh4gbLb38/zddn7wn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4388	1644	WerFault.exe	49

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1644	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 1644	2336	rundll32.exe	49
PID 2336 wrote to memory of 1644	2336	rundll32.exe	49
PID 2336 wrote to memory of 1644	2336	rundll32.exe	49

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d89952c42262ecd51b4d9d6b4e965d2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d89952c42262ecd51b4d9d6b4e965d2.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 640
    3⤵
    - Program crash
    PID:4388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1644 -ip 1644
1⤵
PID:1364