9ac97cfef1b55f12887a95c5b5a680fa7dc40006582f3e4bd3260a966eec0de3

Analysis

max time kernel
160s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 01:46

Target

0a8f8e538a2ac20322d293e9cb4e8c04.dll
Size

17KB
MD5

0a8f8e538a2ac20322d293e9cb4e8c04
SHA1

2ddf96e466a46400fad8700bc3597e92e0749fab
SHA256

9ac97cfef1b55f12887a95c5b5a680fa7dc40006582f3e4bd3260a966eec0de3
SHA512

c694b3437c65be0251d66e69c21e410427b52a2d5f42fa9c9cce5c7b84766b12dc26a6abc96393adaa33ce5b420cc49f64ae1d9ed61a2d02de47736cf0a585de
SSDEEP

384:6ehcM9RWJveQJEnJXF8xFJAg2gVQKOKHGcMgZM2Z:6ehcAIJv+XF8xFJARgGKlMgZZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5072	1244	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 1244	1136	rundll32.exe	87
PID 1136 wrote to memory of 1244	1136	rundll32.exe	87
PID 1136 wrote to memory of 1244	1136	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a8f8e538a2ac20322d293e9cb4e8c04.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a8f8e538a2ac20322d293e9cb4e8c04.dll,#1
  2⤵
  PID:1244
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 576
    3⤵
    - Program crash
    PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1244 -ip 1244
1⤵
PID:2352