e6ff691d2e341c00aa751274bfc0cc7df7439742526c1f9fe85f01b6e562956f

Analysis

max time kernel
65s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12-12-2022 23:25

Target

NewFiles/Issues.dll
Size

733KB
MD5

2ce5d3181724eb9a9cde5c012c62f6cf
SHA1

12cb1f36b803f5fa5c19e1280baeb4fe003ef668
SHA256

c4604b13ad722f6b8232d8b570cd8974d1f75a0e03f7302517374268c148af81
SHA512

5922ebd7b12c6e84a8b4f09c4764064d501461e100e66cf3f1c7b1333b29e8b3bbd258f2cb6074b961806f5fee2abf30cb153ab3d91e5f6f6cdf7d6c93ea64b8
SSDEEP

12288:bx5BlbjoVPn84C8oSZTkwvFsaLJ5sU4gzpl7WQnLI7QAeh+nqb7/ODsrETSeWBE:b/CP1jVtkBKzsU4gL7WZ7tqb72eR

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1360 4656 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1360	4656	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4520 wrote to memory of 4656	4520	rundll32.exe	rundll32.exe
PID 4520 wrote to memory of 4656	4520	rundll32.exe	rundll32.exe
PID 4520 wrote to memory of 4656	4520	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NewFiles\Issues.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4520

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NewFiles\Issues.dll,#1
2⤵
PID:4656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 600
3⤵
- Program crash
PID:1360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4656 -ip 4656
1⤵
PID:4384