b0817a3ca207a1c5a29c442d5e51581f303651648a72b45a2aac6763c6bd2f81

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 16:38

Target

b0817a3ca207a1c5a29c442d5e51581f303651648a72b45a2aac6763c6bd2f81.dll
Size

4.2MB
MD5

83a02eda2daf6d2f3a6420e19c7d616e
SHA1

f44b4929e2b8b0c724000add55763f75234b2713
SHA256

b0817a3ca207a1c5a29c442d5e51581f303651648a72b45a2aac6763c6bd2f81
SHA512

01e5245dddb12289838b260eb914cd5e445589f51653d32f66da533902ab171737a9a8050bf151bf03808bc4563599779f9dbf1f6b4addaafff53bb6effdf8ef
SSDEEP

49152:tl8AZiwh7wI7WxA0gDPWNJ+D9MIl6i66+jccNPWrUEBST1Wt6l:36w50gjSwD9My6i66scbOW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
952	1624	WerFault.exe	84

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1624	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 1624	2656	rundll32.exe	84
PID 2656 wrote to memory of 1624	2656	rundll32.exe	84
PID 2656 wrote to memory of 1624	2656	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b0817a3ca207a1c5a29c442d5e51581f303651648a72b45a2aac6763c6bd2f81.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b0817a3ca207a1c5a29c442d5e51581f303651648a72b45a2aac6763c6bd2f81.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 776
    3⤵
    - Program crash
    PID:952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1624 -ip 1624
1⤵
PID:1068