0acf131c94c09219b980bbbf473e7ffbbc9fbd93d6a0aa7743b818abbf996922

Analysis

max time kernel
140s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2023 12:19

Target

0acf131c94c09219b980bbbf473e7ffbbc9fbd93d6a0aa7743b818abbf996922.dll
Size

2.9MB
MD5

6841b4772845a5f5b2fedc617e2ca5a4
SHA1

a7d948f187c524b8ccbf1a28048e075c791f283f
SHA256

0acf131c94c09219b980bbbf473e7ffbbc9fbd93d6a0aa7743b818abbf996922
SHA512

37e544b630e168954d25abfc6f66720324f6cd1ca3c27c1684a08c9909c9806a2e6f6499d9d7edd3c167927895b56abd9083e6762df4e8adc0e361a2ec5e87f5
SSDEEP

49152:xKy8ZuQZ+7UZF96Ofgu6yEHz7c3z2rESxvVaSZedtWALlQQR0zppnW:xKjCU4Q1ETGzVwvV9Zed5OQO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2272	3156	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 444 wrote to memory of 3156	444	rundll32.exe	85
PID 444 wrote to memory of 3156	444	rundll32.exe	85
PID 444 wrote to memory of 3156	444	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0acf131c94c09219b980bbbf473e7ffbbc9fbd93d6a0aa7743b818abbf996922.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0acf131c94c09219b980bbbf473e7ffbbc9fbd93d6a0aa7743b818abbf996922.dll,#1
  2⤵
  PID:3156
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 848
    3⤵
    - Program crash
    PID:2272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3156 -ip 3156
1⤵
PID:1540