0f0ffe0dfe77c8294bbd3355fe7849951f57ee678464e895f1005d3c90f84c0d

Analysis

max time kernel
181s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 14:17

Target

0f0ffe0dfe77c8294bbd3355fe7849951f57ee678464e895f1005d3c90f84c0d.dll
Size

57KB
MD5

1309bba2afbd70661c6817d0cb5f5a70
SHA1

2ee219138116db1bf8d6a4f6c6531701922871d7
SHA256

0f0ffe0dfe77c8294bbd3355fe7849951f57ee678464e895f1005d3c90f84c0d
SHA512

e059120741a74471042baa87fba019f93806d602a46284f48b64ec772f775a0bac68f94b2e9ee039f727765a68828aa3d077d242ce7174a647f7e50388e1ec96
SSDEEP

384:kERY++H25c/JXzYKUY3R/onoKCAJKOppWY/O7WmfS6eWEYj2cxTcbhyhCpXrfMKY:ncxTSbvkboZWLgVFU9wFnOh8kUomcxT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4448	3768	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 3768	4728	rundll32.exe	80
PID 4728 wrote to memory of 3768	4728	rundll32.exe	80
PID 4728 wrote to memory of 3768	4728	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f0ffe0dfe77c8294bbd3355fe7849951f57ee678464e895f1005d3c90f84c0d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f0ffe0dfe77c8294bbd3355fe7849951f57ee678464e895f1005d3c90f84c0d.dll,#1
  2⤵
  PID:3768
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 640
    3⤵
    - Program crash
    PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3768 -ip 3768
1⤵
PID:4032

memory/3768-133-0x0000000020000000-0x0000000020014000-memory.dmp

Filesize
80KB

Download