4556ee5424b694fdac20053375825b01a608381af1dab4363711009eb2674447

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-12-2022 15:21

Target

NewInformation/LASTInformation.dll
Size

817KB
MD5

65291dd61f21e9dcfe0a0f20aeab044c
SHA1

1cb708aad8bac7e2b97931e24a517a46d6a62c66
SHA256

3f83018f053eabcf37c38bb8fde6e8e4329d433914d7e948c4ea2836f67dbc8e
SHA512

2ff9dba3fe9deeca828219796549bf8d565229707c41962c6375453ad23e2ccc963a71cc0089dbaedb154948831b5bc177434c67730163c5d69efb054466479e
SSDEEP

12288:JJGwvTfCMf8rVomRle7XBr4fi7wDqo4TARMhxMrFND648j4xhT6cl:JY5rVtcsfi7wDP4TAR0sFN+Ux

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1740 1268 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1740	1268	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1196 wrote to memory of 1268	1196	rundll32.exe	rundll32.exe
PID 1196 wrote to memory of 1268	1196	rundll32.exe	rundll32.exe
PID 1196 wrote to memory of 1268	1196	rundll32.exe	rundll32.exe
PID 1196 wrote to memory of 1268	1196	rundll32.exe	rundll32.exe
PID 1196 wrote to memory of 1268	1196	rundll32.exe	rundll32.exe
PID 1196 wrote to memory of 1268	1196	rundll32.exe	rundll32.exe
PID 1196 wrote to memory of 1268	1196	rundll32.exe	rundll32.exe
PID 1268 wrote to memory of 1740	1268	rundll32.exe	WerFault.exe
PID 1268 wrote to memory of 1740	1268	rundll32.exe	WerFault.exe
PID 1268 wrote to memory of 1740	1268	rundll32.exe	WerFault.exe
PID 1268 wrote to memory of 1740	1268	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NewInformation\LASTInformation.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1196

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NewInformation\LASTInformation.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 224
3⤵
- Program crash
PID:1740

memory/1268-54-0x0000000000000000-mapping.dmp

Download
memory/1268-55-0x0000000076531000-0x0000000076533000-memory.dmp

Filesize
8KB

Download
memory/1740-56-0x0000000000000000-mapping.dmp

Download