9f83690b4ba738a40f8993645d5d02d3fda46041bf93a97cbde487fe09e3bb86

Analysis

max time kernel
121s
max time network
136s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
17-06-2024 03:25

Target

Nucleus.Hook32.dll
Size

204KB
MD5

60cf4a67d7b291f96deb0c25abc45136
SHA1

a7cd4d1bc767dcc365e311d9a0b2012ba40f83df
SHA256

4b8fc9cd0679a3a61bd8adca793e23d2caa60fa0663091afd9846f32f247e622
SHA512

b87742ae95e77ba0fad844f4c868e3031d834ccad00e9e555103c71bf0a4de707d0a121958aa088ae547020adef9f1b99dfd4dedabf43c07d5ab6f16f4dfbf86
SSDEEP

3072:U/2dVVPsB3Q9/xokMRuCfn94nPFYRiXGJmZB5tBnnqOqrkZAg0Fuj0JYBK4:UubV1FxoL1nGPFY4XiE5tBHAO7K4

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
3040	1668	WerFault.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid	Process
1668	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	Process	procid_target
PID 2552 wrote to memory of 1668	2552	rundll32.exe	28
PID 2552 wrote to memory of 1668	2552	rundll32.exe	28
PID 2552 wrote to memory of 1668	2552	rundll32.exe	28
PID 2552 wrote to memory of 1668	2552	rundll32.exe	28
PID 2552 wrote to memory of 1668	2552	rundll32.exe	28
PID 2552 wrote to memory of 1668	2552	rundll32.exe	28
PID 2552 wrote to memory of 1668	2552	rundll32.exe	28
PID 1668 wrote to memory of 3040	1668	rundll32.exe	29
PID 1668 wrote to memory of 3040	1668	rundll32.exe	29
PID 1668 wrote to memory of 3040	1668	rundll32.exe	29
PID 1668 wrote to memory of 3040	1668	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Nucleus.Hook32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Nucleus.Hook32.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 268
    3⤵
    - Program crash
    PID:3040