06a7c03d5bdd96a30a32cff0ae0f587fb0e7553b40c43034b90559584adc921f

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 16:49

Target

Client.dll
Size

80KB
MD5

f3b416a29e6305c489cd507e92837347
SHA1

f873f68f05d4eea07a469fe95b67552079cebe39
SHA256

32037c20b69479f81e11a9aff78c112b554d4ebe27823421e508d7cb90b120ee
SHA512

bc0546690767e468b84491edb2e58bb22d8c86df59e31feb85eb97a22a6fbf1425201fc0ee0f493eaef2287519c1752430fef95f82064bee03ef40637bb805c2
SSDEEP

1536:jr2SHjX/yaZRcMIfI6qWm3i/ukIr7nuBTLF+e4m:jrtX/yajL6i3i/iQTR+lm

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	Process	procid_target
412	4468	WerFault.exe	82
2144	4468	WerFault.exe	82

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2384 wrote to memory of 4468	2384	rundll32.exe	82
PID 2384 wrote to memory of 4468	2384	rundll32.exe	82
PID 2384 wrote to memory of 4468	2384	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Client.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Client.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4468
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 552
    3⤵
    - Program crash
    PID:412
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 556
    3⤵
    - Program crash
    PID:2144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4468 -ip 4468
1⤵
PID:1528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4468 -ip 4468
1⤵
PID:4476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4468 -ip 4468
1⤵
PID:3588