790ffa4a97f1d6389bfc265e06c606a66747d75f36efd36f347d7930700e4522

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 23:29

Target
790ffa4a97f1d6389bfc265e06c606a66747d75f36efd36f347d7930700e4522.dll
Size 202KB
Sample240410-3gp9asec42
SHA256 790ffa4a97f1d6389bfc265e06c606a66747d75f36efd36f347d7930700e4522
MD5 7e2e9508b3c288a217a723e41dad9506
SHA1 1c23e74a0e412160b4a7f8f02913f76466818ac7
SHA512 883233c2506fc68db7e57a239d79caa4db1efb147f5c59294936f991549efa39b1836ae0f08e5f9aecd3171bc5831222007223c01cd27c15874c766ce6e62479
SSDEEP 3072:JePTAD1TLmUFm81sBfNZy7wP+K3Ae4mTtf3R1zBXyn+AJceU+:JePC72y7wPeeftfBp0++7U
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4448	4988	WerFault.exe	84

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4988	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 4988	2348	rundll32.exe	84
PID 2348 wrote to memory of 4988	2348	rundll32.exe	84
PID 2348 wrote to memory of 4988	2348	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\790ffa4a97f1d6389bfc265e06c606a66747d75f36efd36f347d7930700e4522.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\790ffa4a97f1d6389bfc265e06c606a66747d75f36efd36f347d7930700e4522.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 864
    3⤵
    - Program crash
    PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4988 -ip 4988
1⤵
PID:4540