0caa901a9155f8828a863b84a1716451b2c6b1fa23b858e843246d02687cf47e

Analysis

max time kernel
183s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 12:34

Target

0caa901a9155f8828a863b84a1716451b2c6b1fa23b858e843246d02687cf47e.dll
Size

618KB
MD5

324e4e306cdb6793268c8afc01f92d0f
SHA1

b1cdce4046eccb181aab3cce32b3a294a8db4c94
SHA256

0caa901a9155f8828a863b84a1716451b2c6b1fa23b858e843246d02687cf47e
SHA512

346f6d2365546b5914f49e8510c2a789679ec2eb2051811bc5e46a25bd9d4f92ef62d4c56698e34298707356ca563be9ae2a6830587cf341b3bff496d7554532
SSDEEP

12288:zvbFgp+LPjwhtotfi9XTPz8HKp5kLpFql2CVVqk4inNT4hTMqnV8Z:zBgAHwhtotaVkeAA2EVqh8NT0Tn

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4716 2676 WerFault.exe rundll32.exe
1160 2676 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4716	2676	WerFault.exe	rundll32.exe
1160	2676	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 4836 wrote to memory of 2676	4836	rundll32.exe	rundll32.exe
PID 4836 wrote to memory of 2676	4836	rundll32.exe	rundll32.exe
PID 4836 wrote to memory of 2676	4836	rundll32.exe	rundll32.exe
PID 2676 wrote to memory of 4716	2676	rundll32.exe	WerFault.exe
PID 2676 wrote to memory of 4716	2676	rundll32.exe	WerFault.exe
PID 2676 wrote to memory of 4716	2676	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0caa901a9155f8828a863b84a1716451b2c6b1fa23b858e843246d02687cf47e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4836

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0caa901a9155f8828a863b84a1716451b2c6b1fa23b858e843246d02687cf47e.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 548
3⤵
- Program crash
PID:4716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 548
3⤵
- Program crash
PID:1160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2676 -ip 2676
1⤵
PID:4768