01f0d3aa5039b031da5e692783faf070c33aaf740a5319cc9303f7831c5b4403

Analysis

max time kernel
90s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 13:41

Target

01f0d3aa5039b031da5e692783faf070c33aaf740a5319cc9303f7831c5b4403.dll
Size

44KB
MD5

d72d81dd50325da54b9b79c95be8a1f9
SHA1

411fb245b43263cebf52a6aab8027fc3b77805fc
SHA256

01f0d3aa5039b031da5e692783faf070c33aaf740a5319cc9303f7831c5b4403
SHA512

c135a8bc62b5d599e37847599e04bd2f507852c197be95c1c01161fd14c65ff67ca27cb3246c0e2ae217c3e3bd06f2152d0f8cadead60b4b2ad0b05f4f4098cb
SSDEEP

768:M9rDLswTpBaoELyVLrLNhdgjrYDh3Fhg/V:M9owTpBaoELSLegDpFe/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1180	1016	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 528 wrote to memory of 1016	528	rundll32.exe	81
PID 528 wrote to memory of 1016	528	rundll32.exe	81
PID 528 wrote to memory of 1016	528	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01f0d3aa5039b031da5e692783faf070c33aaf740a5319cc9303f7831c5b4403.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01f0d3aa5039b031da5e692783faf070c33aaf740a5319cc9303f7831c5b4403.dll,#1
  2⤵
  PID:1016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 600
    3⤵
    - Program crash
    PID:1180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1016 -ip 1016
1⤵
PID:2704