b0d00f412fdea3ae7597cecc2aed7ff14faf274bfb6eb658e5d021333115e3e7

Analysis

max time kernel
140s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 15:29

Target

bb9ba5d2bb2a116eea05f06d734a623f.dll
Size

74KB
MD5

bb9ba5d2bb2a116eea05f06d734a623f
SHA1

8ac9fb830da4d5aeff3194b55f2b7c0583803813
SHA256

b0d00f412fdea3ae7597cecc2aed7ff14faf274bfb6eb658e5d021333115e3e7
SHA512

d98f220f43d4a797dba7bb5db14ed615011677b7336654c03ad082e8b4ae91862a41a657c793d7198120f947c7375f68ea51191749451f3d5792be48fdf22c34
SSDEEP

1536:jTSlUypURoyWcpfabxqVdh7rBl3Q546XSu9G8GXGU+ut:jTSvpUR1WcpVdh3W46XSdGIt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2968	2816	WerFault.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2816	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 2816	2768	rundll32.exe	28
PID 2768 wrote to memory of 2816	2768	rundll32.exe	28
PID 2768 wrote to memory of 2816	2768	rundll32.exe	28
PID 2768 wrote to memory of 2816	2768	rundll32.exe	28
PID 2768 wrote to memory of 2816	2768	rundll32.exe	28
PID 2768 wrote to memory of 2816	2768	rundll32.exe	28
PID 2768 wrote to memory of 2816	2768	rundll32.exe	28
PID 2816 wrote to memory of 2968	2816	rundll32.exe	29
PID 2816 wrote to memory of 2968	2816	rundll32.exe	29
PID 2816 wrote to memory of 2968	2816	rundll32.exe	29
PID 2816 wrote to memory of 2968	2816	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb9ba5d2bb2a116eea05f06d734a623f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb9ba5d2bb2a116eea05f06d734a623f.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 240
    3⤵
    - Program crash
    PID:2968

memory/2816-0-0x0000000000170000-0x000000000018B000-memory.dmp

Filesize
108KB

Download
memory/2816-1-0x0000000000170000-0x000000000018B000-memory.dmp

Filesize
108KB

Download