0ac04d4fe8c108c4462544e7d368f3fdc2a86a540f1598ce1a084d223fbc4014

Analysis

max time kernel
152s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 10:59

Target

0ac04d4fe8c108c4462544e7d368f3fdc2a86a540f1598ce1a084d223fbc4014.dll
Size

114KB
MD5

15852fe007ad88cc8ce4d97ae98d15c0
SHA1

17c1b608de55f479a02c194118a6eeaccf503561
SHA256

0ac04d4fe8c108c4462544e7d368f3fdc2a86a540f1598ce1a084d223fbc4014
SHA512

3de0f38982de65ff82db817876187e3bb2b3ac2cd12d1b2fc1d177fa7e71f37a7c861c131f5f02a03e6e84b1473ed38857bdf612c1a8bf0e259fcd2c4d88e4c2
SSDEEP

3072:BmWwhpSyA4+hlMp8KdO/eymP5/cp9hdbFK:8WbyGl0O/ey8A93F

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
728	1960	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4012 wrote to memory of 1960	4012	rundll32.exe	84
PID 4012 wrote to memory of 1960	4012	rundll32.exe	84
PID 4012 wrote to memory of 1960	4012	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ac04d4fe8c108c4462544e7d368f3fdc2a86a540f1598ce1a084d223fbc4014.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ac04d4fe8c108c4462544e7d368f3fdc2a86a540f1598ce1a084d223fbc4014.dll,#1
  2⤵
  PID:1960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 636
    3⤵
    - Program crash
    PID:728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1960 -ip 1960
1⤵
PID:4376

memory/1960-133-0x0000000000DD0000-0x0000000000DDF000-memory.dmp

Filesize
60KB

Download
memory/1960-134-0x0000000000EC0000-0x0000000000EDF000-memory.dmp

Filesize
124KB

Download
memory/1960-138-0x0000000000DD0000-0x0000000000DDF000-memory.dmp

Filesize
60KB

Download