0d3e9476a10687b66c1e8d29c5c31e0f8a4d7ef933bcc4f17ad075586d74340e

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2023, 11:25

Target

0d3e9476a10687b66c1e8d29c5c31e0f8a4d7ef933bcc4f17ad075586d74340e.dll
Size

2.1MB
MD5

97534fbe14b4eec5d14b9797ee09edd2
SHA1

d31e6acd32ea606fe1328bb1a0c72ed1803d1432
SHA256

0d3e9476a10687b66c1e8d29c5c31e0f8a4d7ef933bcc4f17ad075586d74340e
SHA512

52ff9364e6c5fff59532fe3bf3447bf4af77b662b41b620aeccf6b58ea34e296ebe393d44cda551902a9d7af9955beeeadc72c908862c22485f9c74b0f62be5a
SSDEEP

49152:y8feI79iK2xUrHv31PhbhJ/P0BDpinATs75a78te:y8D7UK2U/tGBDpgh08te

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4564	4732	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 4732	5108	rundll32.exe	84
PID 5108 wrote to memory of 4732	5108	rundll32.exe	84
PID 5108 wrote to memory of 4732	5108	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d3e9476a10687b66c1e8d29c5c31e0f8a4d7ef933bcc4f17ad075586d74340e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d3e9476a10687b66c1e8d29c5c31e0f8a4d7ef933bcc4f17ad075586d74340e.dll,#1
  2⤵
  PID:4732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 552
    3⤵
    - Program crash
    PID:4564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4732 -ip 4732
1⤵
PID:4876