b0d00f412fdea3ae7597cecc2aed7ff14faf274bfb6eb658e5d021333115e3e7

Analysis

max time kernel
91s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-03-2024 15:29

Target

bb9ba5d2bb2a116eea05f06d734a623f.dll
Size

74KB
MD5

bb9ba5d2bb2a116eea05f06d734a623f
SHA1

8ac9fb830da4d5aeff3194b55f2b7c0583803813
SHA256

b0d00f412fdea3ae7597cecc2aed7ff14faf274bfb6eb658e5d021333115e3e7
SHA512

d98f220f43d4a797dba7bb5db14ed615011677b7336654c03ad082e8b4ae91862a41a657c793d7198120f947c7375f68ea51191749451f3d5792be48fdf22c34
SSDEEP

1536:jTSlUypURoyWcpfabxqVdh7rBl3Q546XSu9G8GXGU+ut:jTSvpUR1WcpVdh3W46XSdGIt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1624	4040	WerFault.exe	88

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4040	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 4040	4872	rundll32.exe	88
PID 4872 wrote to memory of 4040	4872	rundll32.exe	88
PID 4872 wrote to memory of 4040	4872	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb9ba5d2bb2a116eea05f06d734a623f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb9ba5d2bb2a116eea05f06d734a623f.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 844
    3⤵
    - Program crash
    PID:1624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4040 -ip 4040
1⤵
PID:112

memory/4040-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download