0ac04d4fe8c108c4462544e7d368f3fdc2a86a540f1598ce1a084d223fbc4014

Analysis

max time kernel
19s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 10:59

Target

0ac04d4fe8c108c4462544e7d368f3fdc2a86a540f1598ce1a084d223fbc4014.dll
Size

114KB
MD5

15852fe007ad88cc8ce4d97ae98d15c0
SHA1

17c1b608de55f479a02c194118a6eeaccf503561
SHA256

0ac04d4fe8c108c4462544e7d368f3fdc2a86a540f1598ce1a084d223fbc4014
SHA512

3de0f38982de65ff82db817876187e3bb2b3ac2cd12d1b2fc1d177fa7e71f37a7c861c131f5f02a03e6e84b1473ed38857bdf612c1a8bf0e259fcd2c4d88e4c2
SSDEEP

3072:BmWwhpSyA4+hlMp8KdO/eymP5/cp9hdbFK:8WbyGl0O/ey8A93F

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
672	1100	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1100	2040	rundll32.exe	28
PID 2040 wrote to memory of 1100	2040	rundll32.exe	28
PID 2040 wrote to memory of 1100	2040	rundll32.exe	28
PID 2040 wrote to memory of 1100	2040	rundll32.exe	28
PID 2040 wrote to memory of 1100	2040	rundll32.exe	28
PID 2040 wrote to memory of 1100	2040	rundll32.exe	28
PID 2040 wrote to memory of 1100	2040	rundll32.exe	28
PID 1100 wrote to memory of 672	1100	rundll32.exe	29
PID 1100 wrote to memory of 672	1100	rundll32.exe	29
PID 1100 wrote to memory of 672	1100	rundll32.exe	29
PID 1100 wrote to memory of 672	1100	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ac04d4fe8c108c4462544e7d368f3fdc2a86a540f1598ce1a084d223fbc4014.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ac04d4fe8c108c4462544e7d368f3fdc2a86a540f1598ce1a084d223fbc4014.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 248
    3⤵
    - Program crash
    PID:672

memory/1100-55-0x00000000761E1000-0x00000000761E3000-memory.dmp

Filesize
8KB

Download
memory/1100-56-0x0000000000160000-0x000000000016F000-memory.dmp

Filesize
60KB

Download
memory/1100-57-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download
memory/1100-62-0x0000000000160000-0x000000000016F000-memory.dmp

Filesize
60KB

Download
memory/1100-63-0x0000000000160000-0x000000000016F000-memory.dmp

Filesize
60KB

Download