d0e5b9e9bc754122450903cfbec6eabfbb67a23ef2d7d764d7ac560498702cb8

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 13:08

Target

0c01e9cde8359571363e488839ab89a0.dll
Size

99KB
MD5

0c01e9cde8359571363e488839ab89a0
SHA1

384f77aedb52908f6f522146d9fa5fe69c1ddad9
SHA256

d0e5b9e9bc754122450903cfbec6eabfbb67a23ef2d7d764d7ac560498702cb8
SHA512

170bbcf042068d1ec085ab0c4a17239498a7afdd0889dce8a12e5c3ef0aebad4630b574959442c1442ebe2602def55d5681906ed649384dd65ed648f48f7990a
SSDEEP

1536:ALfbaFhnhRLHZ3O8Oc8GIdfhhUghXOVh6TTMjYWCj9YUT:+f2L/5+8ObGIFhhUU6h6TTMjYWCj9YUT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3332	2888	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2888	1872	rundll32.exe	88
PID 1872 wrote to memory of 2888	1872	rundll32.exe	88
PID 1872 wrote to memory of 2888	1872	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c01e9cde8359571363e488839ab89a0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c01e9cde8359571363e488839ab89a0.dll,#1
  2⤵
  PID:2888
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 660
    3⤵
    - Program crash
    PID:3332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2888 -ip 2888
1⤵
PID:1204