0c0ddaa9841c5a12cd480a14400e8e9a4f558c22bace62264ee1cfeea7ba8bc2

Analysis

max time kernel
82s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 02:54

Target

0c0ddaa9841c5a12cd480a14400e8e9a4f558c22bace62264ee1cfeea7ba8bc2.dll
Size

96KB
MD5

f0fee9d181d1b0a585399b905881ea9e
SHA1

794e8dca177cc8633d934005c55c9388f555c905
SHA256

0c0ddaa9841c5a12cd480a14400e8e9a4f558c22bace62264ee1cfeea7ba8bc2
SHA512

8e5580eedb020c4649dbde339bfe56dfdae00f5fe30aa8e21e37b1dfc725876038142674896c27f14f84dfe1268746f81d6810e720fdce86b451483cc78803f2
SSDEEP

1536:MGkZlPkC/XxHsBQvxjnj/rXxGGTEQtZAXDhEfiJZJHL0UA2SCYuD9bE4x9++o6aF:Elv/XxHRjnjrPEQcXDhMiJHLZA2SCYUa

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5024	2372	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 2372	3284	rundll32.exe	81
PID 3284 wrote to memory of 2372	3284	rundll32.exe	81
PID 3284 wrote to memory of 2372	3284	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c0ddaa9841c5a12cd480a14400e8e9a4f558c22bace62264ee1cfeea7ba8bc2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c0ddaa9841c5a12cd480a14400e8e9a4f558c22bace62264ee1cfeea7ba8bc2.dll,#1
  2⤵
  PID:2372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 628
    3⤵
    - Program crash
    PID:5024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2372 -ip 2372
1⤵
PID:4824