17c8b471e377c0da1ca8f5d62b26e73712e33c36f440b160e98c4e8089d21df1

Analysis

max time kernel
142s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
13-12-2022 15:12

Target

NewFiles/Changes.dll
Size

733KB
MD5

6a2c99aa4b2a6ff9a77c4131ca8ef2b1
SHA1

5bd2dac0e932491f61d7fb0b1cd2d386082c9d1e
SHA256

7c7648d34a003df5811b2b6adc7eca6fbd8cfc1e343d0caf9408ff4d594fa2b2
SHA512

496ed9a819d31dbc8e77014b7400b6a1fba62fc814a04bb20008b65f8796629d7422f92ffd263ca868a5eb2d403511204cf95582069964a4965ee6dffbae67c9
SSDEEP

12288:bx5BlbjoVPn84C8oSZTkwvFsaLJ5sU4gzplYWQnLI7QAeh+nqb7/ODsrETSeWBE:b/CP1jVtkBKzsU4gLYWZ7tqb72eR

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4984 3588 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4984	3588	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3836 wrote to memory of 3588	3836	rundll32.exe	rundll32.exe
PID 3836 wrote to memory of 3588	3836	rundll32.exe	rundll32.exe
PID 3836 wrote to memory of 3588	3836	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NewFiles\Changes.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3836

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NewFiles\Changes.dll,#1
2⤵
PID:3588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 600
3⤵
- Program crash
PID:4984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3588 -ip 3588
1⤵
PID:3552