9f83690b4ba738a40f8993645d5d02d3fda46041bf93a97cbde487fe09e3bb86

Analysis

max time kernel
142s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17-06-2024 03:25

Target

Nucleus.Hook32.dll
Size

204KB
MD5

60cf4a67d7b291f96deb0c25abc45136
SHA1

a7cd4d1bc767dcc365e311d9a0b2012ba40f83df
SHA256

4b8fc9cd0679a3a61bd8adca793e23d2caa60fa0663091afd9846f32f247e622
SHA512

b87742ae95e77ba0fad844f4c868e3031d834ccad00e9e555103c71bf0a4de707d0a121958aa088ae547020adef9f1b99dfd4dedabf43c07d5ab6f16f4dfbf86
SSDEEP

3072:U/2dVVPsB3Q9/xokMRuCfn94nPFYRiXGJmZB5tBnnqOqrkZAg0Fuj0JYBK4:UubV1FxoL1nGPFY4XiE5tBHAO7K4

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
3556	4724	WerFault.exe	82

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid	Process
4724	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 3252 wrote to memory of 4724	3252	rundll32.exe	82
PID 3252 wrote to memory of 4724	3252	rundll32.exe	82
PID 3252 wrote to memory of 4724	3252	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Nucleus.Hook32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Nucleus.Hook32.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4724
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 864
    3⤵
    - Program crash
    PID:3556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4724 -ip 4724
1⤵
PID:5028