5ea85ac874b09f5b8d48f1490926fa2997ea570a6c62ecdd901f883dd24dc792

Analysis

max time kernel
135s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 22:31

Target
hook.dll
Size 61KB
Sample240213-2ffg2aae9z
SHA256 6fe4157605a28fa3842b9ffc5db266bfcd04ee49c423061d2c8cfa2136822f61
MD5 aea4c6398baa752ea05904a3f236f731
SHA1 d2f10ff8241a5e49a5b9316feacfa099bf49404f
SHA512 84233b15cdc649e80b24de998d0591ad807f73b3eb133b33014c7991a922e37b4fce493e4c96853852113e3fe081637073149143e06f95ae2eb389e3721f195a
SSDEEP 768:GrbF8V2RNjCytT7YF6JoUtXRDMMsi5jiB9pAhnU8g6xGl+Jbl5A/Td2LHvsuhW:GN5LCytT7PoHi5KAU8hxYil5mT4TLA
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1864	1252	WerFault.exe	84

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1252	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 1252	4608	rundll32.exe	84
PID 4608 wrote to memory of 1252	4608	rundll32.exe	84
PID 4608 wrote to memory of 1252	4608	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hook.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\hook.dll,#1
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:1252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 620
    3⤵
    - Program crash
    PID:1864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1252 -ip 1252
1⤵
PID:3928