0f0ffe0dfe77c8294bbd3355fe7849951f57ee678464e895f1005d3c90f84c0d

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 14:17

Target

0f0ffe0dfe77c8294bbd3355fe7849951f57ee678464e895f1005d3c90f84c0d.dll
Size

57KB
MD5

1309bba2afbd70661c6817d0cb5f5a70
SHA1

2ee219138116db1bf8d6a4f6c6531701922871d7
SHA256

0f0ffe0dfe77c8294bbd3355fe7849951f57ee678464e895f1005d3c90f84c0d
SHA512

e059120741a74471042baa87fba019f93806d602a46284f48b64ec772f775a0bac68f94b2e9ee039f727765a68828aa3d077d242ce7174a647f7e50388e1ec96
SSDEEP

384:kERY++H25c/JXzYKUY3R/onoKCAJKOppWY/O7WmfS6eWEYj2cxTcbhyhCpXrfMKY:ncxTSbvkboZWLgVFU9wFnOh8kUomcxT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1932	744	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 744	1660	rundll32.exe	28
PID 1660 wrote to memory of 744	1660	rundll32.exe	28
PID 1660 wrote to memory of 744	1660	rundll32.exe	28
PID 1660 wrote to memory of 744	1660	rundll32.exe	28
PID 1660 wrote to memory of 744	1660	rundll32.exe	28
PID 1660 wrote to memory of 744	1660	rundll32.exe	28
PID 1660 wrote to memory of 744	1660	rundll32.exe	28
PID 744 wrote to memory of 1932	744	rundll32.exe	29
PID 744 wrote to memory of 1932	744	rundll32.exe	29
PID 744 wrote to memory of 1932	744	rundll32.exe	29
PID 744 wrote to memory of 1932	744	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f0ffe0dfe77c8294bbd3355fe7849951f57ee678464e895f1005d3c90f84c0d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f0ffe0dfe77c8294bbd3355fe7849951f57ee678464e895f1005d3c90f84c0d.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 744 -s 256
    3⤵
    - Program crash
    PID:1932

memory/744-55-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

Filesize
8KB

Download
memory/744-57-0x0000000020000000-0x0000000020014000-memory.dmp

Filesize
80KB

Download