17c8b471e377c0da1ca8f5d62b26e73712e33c36f440b160e98c4e8089d21df1

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
13-12-2022 15:12

Target

NewFiles/Changes.dll
Size

733KB
MD5

6a2c99aa4b2a6ff9a77c4131ca8ef2b1
SHA1

5bd2dac0e932491f61d7fb0b1cd2d386082c9d1e
SHA256

7c7648d34a003df5811b2b6adc7eca6fbd8cfc1e343d0caf9408ff4d594fa2b2
SHA512

496ed9a819d31dbc8e77014b7400b6a1fba62fc814a04bb20008b65f8796629d7422f92ffd263ca868a5eb2d403511204cf95582069964a4965ee6dffbae67c9
SSDEEP

12288:bx5BlbjoVPn84C8oSZTkwvFsaLJ5sU4gzplYWQnLI7QAeh+nqb7/ODsrETSeWBE:b/CP1jVtkBKzsU4gLYWZ7tqb72eR

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2040 1296 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2040	1296	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1264 wrote to memory of 1296	1264	rundll32.exe	rundll32.exe
PID 1264 wrote to memory of 1296	1264	rundll32.exe	rundll32.exe
PID 1264 wrote to memory of 1296	1264	rundll32.exe	rundll32.exe
PID 1264 wrote to memory of 1296	1264	rundll32.exe	rundll32.exe
PID 1264 wrote to memory of 1296	1264	rundll32.exe	rundll32.exe
PID 1264 wrote to memory of 1296	1264	rundll32.exe	rundll32.exe
PID 1264 wrote to memory of 1296	1264	rundll32.exe	rundll32.exe
PID 1296 wrote to memory of 2040	1296	rundll32.exe	WerFault.exe
PID 1296 wrote to memory of 2040	1296	rundll32.exe	WerFault.exe
PID 1296 wrote to memory of 2040	1296	rundll32.exe	WerFault.exe
PID 1296 wrote to memory of 2040	1296	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NewFiles\Changes.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1264

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NewFiles\Changes.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 224
3⤵
- Program crash
PID:2040

memory/1296-54-0x0000000000000000-mapping.dmp

Download
memory/1296-55-0x0000000075531000-0x0000000075533000-memory.dmp

Filesize
8KB

Download
memory/2040-56-0x0000000000000000-mapping.dmp

Download