e7f0ac625a8de32f46fcd35a4eb9134a18754a4316fb4c30f4277502160f3103

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 04:41

Target

c7b6e97767ffd70745f85cd2e0b9b750.dll
Size

86KB
MD5

c7b6e97767ffd70745f85cd2e0b9b750
SHA1

35fc060ee1af2933f29259d09a402ade1c8e5f9f
SHA256

e7f0ac625a8de32f46fcd35a4eb9134a18754a4316fb4c30f4277502160f3103
SHA512

c67118cf27c6ddf55d1e28c1c50972dfa5afd43dacd8e9c19a1d0976ba2c47fc3412b3edd885d3481a71748847971b5b9aba789a99b644235367c85cfff54415
SSDEEP

1536:Ea/20jtCZIxEw5jOdSs/54sDxnsjcFIpofOc2IwfEZGk/RaPkmIeWaQxD4zOG+7S:Ea/dj5jOwU4sDxn9tGc23cZPRawsqO+W

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4048	584	WerFault.exe	89

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
584	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 584	3880	rundll32.exe	89
PID 3880 wrote to memory of 584	3880	rundll32.exe	89
PID 3880 wrote to memory of 584	3880	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c7b6e97767ffd70745f85cd2e0b9b750.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c7b6e97767ffd70745f85cd2e0b9b750.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 584 -s 644
    3⤵
    - Program crash
    PID:4048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 584 -ip 584
1⤵
PID:2852

memory/584-0-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/584-1-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/584-2-0x00000000012B0000-0x00000000012B1000-memory.dmp

Filesize
4KB

Download
memory/584-3-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/584-5-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/584-6-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/584-4-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/584-7-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download