0b8605aa8d9df88d54ce3bd80c55752483cbd67c8958d04ebaa52950b20e8911

Analysis

max time kernel
161s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2023 22:48

Target

0b8605aa8d9df88d54ce3bd80c55752483cbd67c8958d04ebaa52950b20e8911.dll
Size

208KB
MD5

a53ad99d76d6df2b3bc845409f5d4910
SHA1

976b782f0b9157134d5b4443e3ff1437a2cc8c55
SHA256

0b8605aa8d9df88d54ce3bd80c55752483cbd67c8958d04ebaa52950b20e8911
SHA512

9aac57958bc2b23f5e634e1310d8f3ac56d9eafdedc06a80a3ef23fa940f7b6d43cb1efa25157d654a68007690a0d3ab203e723f1630944a7da09aa0088b3605
SSDEEP

3072:cI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUMPfY5g+v:cIDff9D8C6XYRw6MT2DEj/k

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
412	3768	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 3768	2960	rundll32.exe	85
PID 2960 wrote to memory of 3768	2960	rundll32.exe	85
PID 2960 wrote to memory of 3768	2960	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b8605aa8d9df88d54ce3bd80c55752483cbd67c8958d04ebaa52950b20e8911.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b8605aa8d9df88d54ce3bd80c55752483cbd67c8958d04ebaa52950b20e8911.dll,#1
  2⤵
  PID:3768
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 588
    3⤵
    - Program crash
    PID:412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3768 -ip 3768
1⤵
PID:2140