a8c2723dc7adde6909f57e677d2e810d38caba5acb38a981ec16f8a91fab6b0c

Analysis

max time kernel
125s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
16-01-2023 21:29

Target

NewInformation/LASTInformation.dll
Size

817KB
MD5

65291dd61f21e9dcfe0a0f20aeab044c
SHA1

1cb708aad8bac7e2b97931e24a517a46d6a62c66
SHA256

3f83018f053eabcf37c38bb8fde6e8e4329d433914d7e948c4ea2836f67dbc8e
SHA512

2ff9dba3fe9deeca828219796549bf8d565229707c41962c6375453ad23e2ccc963a71cc0089dbaedb154948831b5bc177434c67730163c5d69efb054466479e
SSDEEP

12288:JJGwvTfCMf8rVomRle7XBr4fi7wDqo4TARMhxMrFND648j4xhT6cl:JY5rVtcsfi7wDP4TAR0sFN+Ux

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2036 4848 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2036	4848	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1852 wrote to memory of 4848	1852	rundll32.exe	rundll32.exe
PID 1852 wrote to memory of 4848	1852	rundll32.exe	rundll32.exe
PID 1852 wrote to memory of 4848	1852	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NewInformation\LASTInformation.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1852

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NewInformation\LASTInformation.dll,#1
2⤵
PID:4848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 612
3⤵
- Program crash
PID:2036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 4848 -ip 4848
1⤵
PID:604