cd1c25dd94c4ea3aacb4b6b3b37a5922eb0feb4cbf505d7c6c29705b9ac14a21

Analysis

max time kernel
39s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-01-2023 07:39

Target

NewInformation/NewIssues.dll
Size

817KB
MD5

7db2241ddce77297d6a6fd44c57386a7
SHA1

6565677c9ccf0805af012b641d2a75354ed290d6
SHA256

fcb79d3aa7ee29b7a6dca44bc061abbe521089edb79d6596ada71b05c64b4a8a
SHA512

a42ed635d896b5b7ef8200facdf4b90e236afd83cc02b492be702ffd23bb475816776a2b462ed1b16975b7317b3d59eeeeba919e6458973a0161aa6a18a99d70
SSDEEP

12288:JJGwvTfCMf8rVomRle7XBr4fi7wDqo4TARMhxMrFND648j4xhT6dl:JY5rVtcsfi7wDP4TAR0sFN+Ux

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1708 884 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1708	884	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2040 wrote to memory of 884	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 884	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 884	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 884	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 884	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 884	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 884	2040	rundll32.exe	rundll32.exe
PID 884 wrote to memory of 1708	884	rundll32.exe	WerFault.exe
PID 884 wrote to memory of 1708	884	rundll32.exe	WerFault.exe
PID 884 wrote to memory of 1708	884	rundll32.exe	WerFault.exe
PID 884 wrote to memory of 1708	884	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NewInformation\NewIssues.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NewInformation\NewIssues.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 224
3⤵
- Program crash
PID:1708

memory/884-54-0x0000000000000000-mapping.dmp

Download
memory/884-55-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/1708-56-0x0000000000000000-mapping.dmp

Download