4556ee5424b694fdac20053375825b01a608381af1dab4363711009eb2674447

Analysis

max time kernel
83s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2022 15:21

Target

NewInformation/LASTInformation.dll
Size

817KB
MD5

65291dd61f21e9dcfe0a0f20aeab044c
SHA1

1cb708aad8bac7e2b97931e24a517a46d6a62c66
SHA256

3f83018f053eabcf37c38bb8fde6e8e4329d433914d7e948c4ea2836f67dbc8e
SHA512

2ff9dba3fe9deeca828219796549bf8d565229707c41962c6375453ad23e2ccc963a71cc0089dbaedb154948831b5bc177434c67730163c5d69efb054466479e
SSDEEP

12288:JJGwvTfCMf8rVomRle7XBr4fi7wDqo4TARMhxMrFND648j4xhT6cl:JY5rVtcsfi7wDP4TAR0sFN+Ux

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4764 4904 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4764	4904	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4856 wrote to memory of 4904	4856	rundll32.exe	rundll32.exe
PID 4856 wrote to memory of 4904	4856	rundll32.exe	rundll32.exe
PID 4856 wrote to memory of 4904	4856	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NewInformation\LASTInformation.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4856

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NewInformation\LASTInformation.dll,#1
2⤵
PID:4904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 612
3⤵
- Program crash
PID:4764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4904 -ip 4904
1⤵
PID:904