0e1f44187d73e706600e63c7ffb8132be360e44962a4f6ef2e34f53cdd8681b2

Analysis

max time kernel
90s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2022 19:11

Target

YouNewRules.dll
Size

516KB
MD5

934ce14971f8b392035091f6c4b8359b
SHA1

1c64dc1cf040e89834a787722ed49367d515184c
SHA256

0e1f44187d73e706600e63c7ffb8132be360e44962a4f6ef2e34f53cdd8681b2
SHA512

0cc8d1645913f8a44cfd7d7f5a1e83f5416637f62ce54cf07fee88673d81c567598633dac60dcc38484a12cb4f3a329326690b642e01e6a7ced4824a7ac3e147
SSDEEP

6144:wiIqnct7uycRpLrFPQleGc2BpeQvfTiD3MJIyFX+OwjzK9y9KOc6rXPMATcBu:wihnctArBgRprvbiIIAuz19nTMAgc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2324	4996	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 4996	1776	rundll32.exe	81
PID 1776 wrote to memory of 4996	1776	rundll32.exe	81
PID 1776 wrote to memory of 4996	1776	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\YouNewRules.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\YouNewRules.dll,#1
  2⤵
  PID:4996
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 600
    3⤵
    - Program crash
    PID:2324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4996 -ip 4996
1⤵
PID:1516