9fa62c3ddaf2dd59c3aa8d08f0bdfc0190ccabb00b26c71188f2490b00ad5c8e

Analysis

max time kernel
137s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
18-01-2024 01:31

Target

9fa62c3ddaf2dd59c3aa8d08f0bdfc0190ccabb00b26c71188f2490b00ad5c8e.dll
Size

4.8MB
MD5

7eb275addd35f73c0ac59793eaf09e8e
SHA1

abcd4216c69d019830e08a0a5b4a802668924799
SHA256

9fa62c3ddaf2dd59c3aa8d08f0bdfc0190ccabb00b26c71188f2490b00ad5c8e
SHA512

bf30da6127e6e585e28c0e26a42f3bed00a6de92c73ae83c11b950cbc9fb1aecae180bf49ed7b0f8fa1ddcf40ab551ec030ca095de1f27ac908fd76f91fd25b1
SSDEEP

98304:gBjdYwQzfPIhmw3D68gHz20wzXKYgTpocuuzu4C6Pb:Q1QzfAIw3D68gHz20wzXKYgTpocuuzuo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
696	4492	WerFault.exe	19

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4492	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 4492	3536	rundll32.exe	19
PID 3536 wrote to memory of 4492	3536	rundll32.exe	19
PID 3536 wrote to memory of 4492	3536	rundll32.exe	19

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9fa62c3ddaf2dd59c3aa8d08f0bdfc0190ccabb00b26c71188f2490b00ad5c8e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9fa62c3ddaf2dd59c3aa8d08f0bdfc0190ccabb00b26c71188f2490b00ad5c8e.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4492
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4492 -s 708
    3⤵
    - Program crash
    PID:696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4492 -ip 4492
1⤵
PID:2352