909df004857e854a646328179d73a9738eec6b2eb559be3b0cd8d3c53b3dd29a

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 05:06

Target

Fix/AntiDllHiJack.dll
Size

101KB
MD5

4e530cb477269a470521c8de665cf705
SHA1

45c69eb4e32e8309d44742d7da9ebcb19575bb73
SHA256

76b512ab64995cbd6d965ca5ecc38d9ced67a1f9450da9e6f9ae1f5492068273
SHA512

2e0ac7f8664864e9e62c0ccf1eac68df8f0b8b536c4b5544ced4f8f0aa694dca3cedca42e7ee3d1e61c05ad7b1a9b6c147d66055ad71a7db0caf6559d5cac216
SSDEEP

1536:oiVNz8Ekk2yQ73ZiOsMz5kHOmtTT326FoQlAn2oxswg0wEn4O:9l8bk2yQ73Ldkuw3NlATg0Pnb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2492	2256	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 2256	1868	rundll32.exe	28
PID 1868 wrote to memory of 2256	1868	rundll32.exe	28
PID 1868 wrote to memory of 2256	1868	rundll32.exe	28
PID 1868 wrote to memory of 2256	1868	rundll32.exe	28
PID 1868 wrote to memory of 2256	1868	rundll32.exe	28
PID 1868 wrote to memory of 2256	1868	rundll32.exe	28
PID 1868 wrote to memory of 2256	1868	rundll32.exe	28
PID 2256 wrote to memory of 2492	2256	rundll32.exe	29
PID 2256 wrote to memory of 2492	2256	rundll32.exe	29
PID 2256 wrote to memory of 2492	2256	rundll32.exe	29
PID 2256 wrote to memory of 2492	2256	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fix\AntiDllHiJack.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fix\AntiDllHiJack.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 232
    3⤵
    - Program crash
    PID:2492