7a276219baf25eac0f97a7b3a219d78cd03330b4c15db52d4fd6a9e0eca2c672

Analysis

max time kernel
38s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
13-12-2022 07:18

Target

InvoiceUpdate/NeedChangeRules.dll
Size

733KB
MD5

b37107701ed8936daba7d88adb4fd128
SHA1

ae26543cc5e3b50f6b3edfdcc3b1f964354a31aa
SHA256

e1fb048ebc4508feaa9f9180b038943150ac472548fe92d32504d5b5b19a93f3
SHA512

91c3f1f68a05eea65b5113d75a59f6e68bc12b24cdcd4bdcf113cc7ed8a0de80720b2bbf7729c7317b389ec8cea1fd7c7e3d167d041f438f27695cf5dbbafe83
SSDEEP

12288:bx5BlbjoVPn84C8oSZTkwvFsaLJ5sU4gzplgWQnLI7QAeh+nqb7/ODsrETSeWBE:b/CP1jVtkBKzsU4gLgWZ7tqb72eR

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

844 1956 WerFault.exe rundll32.exe

pid	pid_target	process	target process
844	1956	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1404 wrote to memory of 1956	1404	rundll32.exe	rundll32.exe
PID 1404 wrote to memory of 1956	1404	rundll32.exe	rundll32.exe
PID 1404 wrote to memory of 1956	1404	rundll32.exe	rundll32.exe
PID 1404 wrote to memory of 1956	1404	rundll32.exe	rundll32.exe
PID 1404 wrote to memory of 1956	1404	rundll32.exe	rundll32.exe
PID 1404 wrote to memory of 1956	1404	rundll32.exe	rundll32.exe
PID 1404 wrote to memory of 1956	1404	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 844	1956	rundll32.exe	WerFault.exe
PID 1956 wrote to memory of 844	1956	rundll32.exe	WerFault.exe
PID 1956 wrote to memory of 844	1956	rundll32.exe	WerFault.exe
PID 1956 wrote to memory of 844	1956	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\InvoiceUpdate\NeedChangeRules.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1404

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\InvoiceUpdate\NeedChangeRules.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 224
3⤵
- Program crash
PID:844

memory/844-56-0x0000000000000000-mapping.dmp

Download
memory/1956-54-0x0000000000000000-mapping.dmp

Download
memory/1956-55-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download