d0e0a3c31ca1370832af5404428787a013bb848eb16ac1dd0c6f4064dcb978a2

Analysis

max time kernel
225s
max time network
292s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2023, 04:39

Target

d0.dll
Size

1.5MB
MD5

add26ba2bcc47e324615a2f037270b18
SHA1

b7f33d21c8d4760af04887948ee94073e020a6a2
SHA256

d0e0a3c31ca1370832af5404428787a013bb848eb16ac1dd0c6f4064dcb978a2
SHA512

c1159e7cc553fc6c1ee1f9923027645f4a01284e075bad96d6a02d3d5f3dab0a72bf37bf446e8e63a40f9bf04d7066050b029f89950f1c043a990370207bb6f3
SSDEEP

12288:31Y5rKeRVazvXDAlG0NJeM6Wr+Ag4FLx+MKJI9J2sGiG4Zil2oNu6tZgSNEe4:3IGeg7AlnNc5X4FLxh9A0Jisp6XFEe4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4356	544	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3220 wrote to memory of 544	3220	rundll32.exe	80
PID 3220 wrote to memory of 544	3220	rundll32.exe	80
PID 3220 wrote to memory of 544	3220	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d0.dll,#1
  2⤵
  PID:544
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 544 -s 596
    3⤵
    - Program crash
    PID:4356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 544 -ip 544
1⤵
PID:240

memory/544-133-0x00000000753A0000-0x000000007548F000-memory.dmp

Filesize
956KB

Download
memory/544-134-0x0000000002620000-0x000000000274C000-memory.dmp

Filesize
1.2MB

Download
memory/544-135-0x0000000002760000-0x0000000002764000-memory.dmp

Filesize
16KB

Download
memory/544-136-0x00000000753A0000-0x000000007548F000-memory.dmp

Filesize
956KB

Download
memory/544-137-0x0000000002620000-0x000000000274C000-memory.dmp

Filesize
1.2MB

Download