a8c2723dc7adde6909f57e677d2e810d38caba5acb38a981ec16f8a91fab6b0c

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
16-01-2023 21:29

Target

NewInformation/LASTInformation.dll
Size

817KB
MD5

65291dd61f21e9dcfe0a0f20aeab044c
SHA1

1cb708aad8bac7e2b97931e24a517a46d6a62c66
SHA256

3f83018f053eabcf37c38bb8fde6e8e4329d433914d7e948c4ea2836f67dbc8e
SHA512

2ff9dba3fe9deeca828219796549bf8d565229707c41962c6375453ad23e2ccc963a71cc0089dbaedb154948831b5bc177434c67730163c5d69efb054466479e
SSDEEP

12288:JJGwvTfCMf8rVomRle7XBr4fi7wDqo4TARMhxMrFND648j4xhT6cl:JY5rVtcsfi7wDP4TAR0sFN+Ux

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1620 1904 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1620	1904	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 968 wrote to memory of 1904	968	rundll32.exe	rundll32.exe
PID 968 wrote to memory of 1904	968	rundll32.exe	rundll32.exe
PID 968 wrote to memory of 1904	968	rundll32.exe	rundll32.exe
PID 968 wrote to memory of 1904	968	rundll32.exe	rundll32.exe
PID 968 wrote to memory of 1904	968	rundll32.exe	rundll32.exe
PID 968 wrote to memory of 1904	968	rundll32.exe	rundll32.exe
PID 968 wrote to memory of 1904	968	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 1620	1904	rundll32.exe	WerFault.exe
PID 1904 wrote to memory of 1620	1904	rundll32.exe	WerFault.exe
PID 1904 wrote to memory of 1620	1904	rundll32.exe	WerFault.exe
PID 1904 wrote to memory of 1620	1904	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NewInformation\LASTInformation.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:968

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NewInformation\LASTInformation.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 224
3⤵
- Program crash
PID:1620

memory/1620-56-0x0000000000000000-mapping.dmp

Download
memory/1904-54-0x0000000000000000-mapping.dmp

Download
memory/1904-55-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download