0cb6dfa3db8548fe357957906712d14e0f32a2e8b30c9c60636df85370155852

Analysis

max time kernel
234s
max time network
266s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 06:09

Target
0cb6dfa3db8548fe357957906712d14e0f32a2e8b30c9c60636df85370155852.dll
Size 233KB
Sample221201-gwkfpseg6s
SHA256 0cb6dfa3db8548fe357957906712d14e0f32a2e8b30c9c60636df85370155852
MD5 cedc7139d3247efdd94c0e0ff17abd19
SHA1 47969f17abf163ccc3a12ac2d57bf234ebd5f044
SHA512 b43a4214c9032a04cd8d954ab46ef53c790fc8547b347f2424832732bc5f2f2829510df0fdd3dd98bb0720aaa2b6ae2df4d733b8aa5723d25d02a328d6565102
SSDEEP 6144:RvI11NXZTWO0nML7xDrUTyT4KFEYRhna2:Rc1NX9WOn7pUI4CRlJ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3748	2096	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 2096	3168	rundll32.exe	80
PID 3168 wrote to memory of 2096	3168	rundll32.exe	80
PID 3168 wrote to memory of 2096	3168	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0cb6dfa3db8548fe357957906712d14e0f32a2e8b30c9c60636df85370155852.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0cb6dfa3db8548fe357957906712d14e0f32a2e8b30c9c60636df85370155852.dll,#1
  2⤵
  PID:2096
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 580
    3⤵
    - Program crash
    PID:3748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2096 -ip 2096
1⤵
PID:4808