857113e1eaecdec5c2670941251b1d0745d6784c1b74f51efad72a74b6a7dbc5

Analysis

max time kernel
131s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 22:25

Target

857113e1eaecdec5c2670941251b1d0745d6784c1b74f51efad72a74b6a7dbc5.dll
Size

828KB
MD5

37517fbb3d655f620a871aced0c03e73
SHA1

e498d91dc51dd14f1249c2300ea49b65fd3bace2
SHA256

857113e1eaecdec5c2670941251b1d0745d6784c1b74f51efad72a74b6a7dbc5
SHA512

e03bab8ffad428a8ea79306a334578517c547ce58923ef8cf2920b9d08ac0667d55fe2d22a4038aea4f13fa7c25d70075917000130e38580ea04846774f0ce4a
SSDEEP

12288:TT4qxZA9D36MG+fD2Ww6+Q9esqH+eMnWpy:TTpeh3xG+KWxt4Vppy

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3972 4904 WerFault.exe rundll32.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

rundll32.exe

pid process

4904 rundll32.exe
4904 rundll32.exe
4904 rundll32.exe
4904 rundll32.exe
4904 rundll32.exe

pid	pid_target	process	target process
3972	4904	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2476 wrote to memory of 4904	2476	rundll32.exe	rundll32.exe
PID 2476 wrote to memory of 4904	2476	rundll32.exe	rundll32.exe
PID 2476 wrote to memory of 4904	2476	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\857113e1eaecdec5c2670941251b1d0745d6784c1b74f51efad72a74b6a7dbc5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\857113e1eaecdec5c2670941251b1d0745d6784c1b74f51efad72a74b6a7dbc5.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4904
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 720
    3⤵
    - Program crash
    PID:3972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4904 -ip 4904
1⤵
PID:3528