c0c015ef4879f735a1ad5ec53dd7d460af05d6bbb7df07a93bebc7626944bf02

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 15:56

Target

c0c015ef4879f735a1ad5ec53dd7d460af05d6bbb7df07a93bebc7626944bf02.dll
Size

1.2MB
MD5

3660f12fc23432573aac7e62d3cdadf0
SHA1

8c166d8c9f109b3f727f76478a4bd024ddf25759
SHA256

c0c015ef4879f735a1ad5ec53dd7d460af05d6bbb7df07a93bebc7626944bf02
SHA512

25edb1f467511f7d01a34484098da707339915bd2dfbc73c00d4b6275ddd5bc9d3ae03c30b18a97ea480c053f0915fb51a2b24d566741167d205ea5fe743eef8
SSDEEP

24576:EzQXk51iKn6ym3cva/LLR0iutSz9oCzW/mM4cFfPjCGHifq9G:2kgnjm3P3R0rt29h6mMBP+RC9G

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2728	3860	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 3860	5112	rundll32.exe	87
PID 5112 wrote to memory of 3860	5112	rundll32.exe	87
PID 5112 wrote to memory of 3860	5112	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0c015ef4879f735a1ad5ec53dd7d460af05d6bbb7df07a93bebc7626944bf02.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0c015ef4879f735a1ad5ec53dd7d460af05d6bbb7df07a93bebc7626944bf02.dll,#1
  2⤵
  PID:3860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 576
    3⤵
    - Program crash
    PID:2728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3860 -ip 3860
1⤵
PID:2224

memory/3860-0-0x00000000751F0000-0x0000000075327000-memory.dmp

Filesize
1.2MB

Download
memory/3860-1-0x0000000077290000-0x00000000774A5000-memory.dmp

Filesize
2.1MB

Download