e6ff691d2e341c00aa751274bfc0cc7df7439742526c1f9fe85f01b6e562956f

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
12-12-2022 23:25

Target

NewFiles/Issues.dll
Size

733KB
MD5

2ce5d3181724eb9a9cde5c012c62f6cf
SHA1

12cb1f36b803f5fa5c19e1280baeb4fe003ef668
SHA256

c4604b13ad722f6b8232d8b570cd8974d1f75a0e03f7302517374268c148af81
SHA512

5922ebd7b12c6e84a8b4f09c4764064d501461e100e66cf3f1c7b1333b29e8b3bbd258f2cb6074b961806f5fee2abf30cb153ab3d91e5f6f6cdf7d6c93ea64b8
SSDEEP

12288:bx5BlbjoVPn84C8oSZTkwvFsaLJ5sU4gzpl7WQnLI7QAeh+nqb7/ODsrETSeWBE:b/CP1jVtkBKzsU4gL7WZ7tqb72eR

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1996 1712 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1996	1712	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1764 wrote to memory of 1712	1764	rundll32.exe	rundll32.exe
PID 1764 wrote to memory of 1712	1764	rundll32.exe	rundll32.exe
PID 1764 wrote to memory of 1712	1764	rundll32.exe	rundll32.exe
PID 1764 wrote to memory of 1712	1764	rundll32.exe	rundll32.exe
PID 1764 wrote to memory of 1712	1764	rundll32.exe	rundll32.exe
PID 1764 wrote to memory of 1712	1764	rundll32.exe	rundll32.exe
PID 1764 wrote to memory of 1712	1764	rundll32.exe	rundll32.exe
PID 1712 wrote to memory of 1996	1712	rundll32.exe	WerFault.exe
PID 1712 wrote to memory of 1996	1712	rundll32.exe	WerFault.exe
PID 1712 wrote to memory of 1996	1712	rundll32.exe	WerFault.exe
PID 1712 wrote to memory of 1996	1712	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NewFiles\Issues.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1764

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NewFiles\Issues.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 224
3⤵
- Program crash
PID:1996

memory/1712-54-0x0000000000000000-mapping.dmp

Download
memory/1712-55-0x0000000074E61000-0x0000000074E63000-memory.dmp

Filesize
8KB

Download
memory/1996-56-0x0000000000000000-mapping.dmp

Download