0acf131c94c09219b980bbbf473e7ffbbc9fbd93d6a0aa7743b818abbf996922

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
21/11/2023, 12:19

Target

0acf131c94c09219b980bbbf473e7ffbbc9fbd93d6a0aa7743b818abbf996922.dll
Size

2.9MB
MD5

6841b4772845a5f5b2fedc617e2ca5a4
SHA1

a7d948f187c524b8ccbf1a28048e075c791f283f
SHA256

0acf131c94c09219b980bbbf473e7ffbbc9fbd93d6a0aa7743b818abbf996922
SHA512

37e544b630e168954d25abfc6f66720324f6cd1ca3c27c1684a08c9909c9806a2e6f6499d9d7edd3c167927895b56abd9083e6762df4e8adc0e361a2ec5e87f5
SSDEEP

49152:xKy8ZuQZ+7UZF96Ofgu6yEHz7c3z2rESxvVaSZedtWALlQQR0zppnW:xKjCU4Q1ETGzVwvV9Zed5OQO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2928	2208	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2208	2872	rundll32.exe	28
PID 2872 wrote to memory of 2208	2872	rundll32.exe	28
PID 2872 wrote to memory of 2208	2872	rundll32.exe	28
PID 2872 wrote to memory of 2208	2872	rundll32.exe	28
PID 2872 wrote to memory of 2208	2872	rundll32.exe	28
PID 2872 wrote to memory of 2208	2872	rundll32.exe	28
PID 2872 wrote to memory of 2208	2872	rundll32.exe	28
PID 2208 wrote to memory of 2928	2208	rundll32.exe	29
PID 2208 wrote to memory of 2928	2208	rundll32.exe	29
PID 2208 wrote to memory of 2928	2208	rundll32.exe	29
PID 2208 wrote to memory of 2928	2208	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0acf131c94c09219b980bbbf473e7ffbbc9fbd93d6a0aa7743b818abbf996922.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0acf131c94c09219b980bbbf473e7ffbbc9fbd93d6a0aa7743b818abbf996922.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 292
    3⤵
    - Program crash
    PID:2928