8a5c8a4b4d05ccd8a4826598f219081319e153be0a5a13a9e27b8baba286f74c

Analysis

max time kernel
41s
max time network
48s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 17:22

Target

8a5c8a4b4d05ccd8a4826598f219081319e153be0a5a13a9e27b8baba286f74c.dll
Size

756KB
MD5

5d74dd9740e59e0e740c164da209723b
SHA1

a43b281b74d06b0c86f3e6819aadca2a6076b60b
SHA256

8a5c8a4b4d05ccd8a4826598f219081319e153be0a5a13a9e27b8baba286f74c
SHA512

50a5ba66b68bc0ea0e2c0df185c9e9351b1af5475c867454cf31de1cfa6a21ecfc18094a4ca4bccec824ebb940536f88adf8dc298ea0328e9f9d8d7965396948
SSDEEP

6144:6rcRusjLlf0cnh4sAHcf1ty6yZfKN22NkuiWMn1MpoqnseHcSDF7WKBcAkMyLVST:6rcRuSLlMK1U2qj2SJeHcKXcLJC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4144	3464	WerFault.exe	81

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3464	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 3464	4268	rundll32.exe	81
PID 4268 wrote to memory of 3464	4268	rundll32.exe	81
PID 4268 wrote to memory of 3464	4268	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8a5c8a4b4d05ccd8a4826598f219081319e153be0a5a13a9e27b8baba286f74c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8a5c8a4b4d05ccd8a4826598f219081319e153be0a5a13a9e27b8baba286f74c.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 692
    3⤵
    - Program crash
    PID:4144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3464 -ip 3464
1⤵
PID:372