0b8605aa8d9df88d54ce3bd80c55752483cbd67c8958d04ebaa52950b20e8911

Analysis

max time kernel
161s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2023 22:48

Target

0b8605aa8d9df88d54ce3bd80c55752483cbd67c8958d04ebaa52950b20e8911.dll
Size

208KB
MD5

a53ad99d76d6df2b3bc845409f5d4910
SHA1

976b782f0b9157134d5b4443e3ff1437a2cc8c55
SHA256

0b8605aa8d9df88d54ce3bd80c55752483cbd67c8958d04ebaa52950b20e8911
SHA512

9aac57958bc2b23f5e634e1310d8f3ac56d9eafdedc06a80a3ef23fa940f7b6d43cb1efa25157d654a68007690a0d3ab203e723f1630944a7da09aa0088b3605
SSDEEP

3072:cI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUMPfY5g+v:cIDff9D8C6XYRw6MT2DEj/k

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

412 3768 WerFault.exe rundll32.exe

pid	pid_target	process	target process
412	3768	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2960 wrote to memory of 3768	2960	rundll32.exe	rundll32.exe
PID 2960 wrote to memory of 3768	2960	rundll32.exe	rundll32.exe
PID 2960 wrote to memory of 3768	2960	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b8605aa8d9df88d54ce3bd80c55752483cbd67c8958d04ebaa52950b20e8911.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2960

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b8605aa8d9df88d54ce3bd80c55752483cbd67c8958d04ebaa52950b20e8911.dll,#1
2⤵
PID:3768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 588
3⤵
- Program crash
PID:412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3768 -ip 3768
1⤵
PID:2140