0f9bd1139fd1a41de60657f03e0758d7b3ed9f1128b2fbc0c8a2aace3c1ca10c

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 18:43

Target

0f9bd1139fd1a41de60657f03e0758d7b3ed9f1128b2fbc0c8a2aace3c1ca10c.dll
Size

995KB
MD5

d80871174d8ed87a2379e4b2a69f5535
SHA1

2c97d871066627890b8cf64d6097f0d9ecde9a1e
SHA256

0f9bd1139fd1a41de60657f03e0758d7b3ed9f1128b2fbc0c8a2aace3c1ca10c
SHA512

ea0d37380ea32544e4c26f61a01bbd7438d48bca71ed1df7b5dab84ea772792b013b61a0722ae6ed248b816a31aeeddb022fb5b1309ebe7970e48406c18f6b2a
SSDEEP

24576:47t1xRKpE/YN5B41dNKgUwi14NENdeNEVRIqOmT:gdH4wxcde4pB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3004	2700	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2700	2536	rundll32.exe	28
PID 2536 wrote to memory of 2700	2536	rundll32.exe	28
PID 2536 wrote to memory of 2700	2536	rundll32.exe	28
PID 2536 wrote to memory of 2700	2536	rundll32.exe	28
PID 2536 wrote to memory of 2700	2536	rundll32.exe	28
PID 2536 wrote to memory of 2700	2536	rundll32.exe	28
PID 2536 wrote to memory of 2700	2536	rundll32.exe	28
PID 2700 wrote to memory of 3004	2700	rundll32.exe	29
PID 2700 wrote to memory of 3004	2700	rundll32.exe	29
PID 2700 wrote to memory of 3004	2700	rundll32.exe	29
PID 2700 wrote to memory of 3004	2700	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f9bd1139fd1a41de60657f03e0758d7b3ed9f1128b2fbc0c8a2aace3c1ca10c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f9bd1139fd1a41de60657f03e0758d7b3ed9f1128b2fbc0c8a2aace3c1ca10c.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 228
    3⤵
    - Program crash
    PID:3004