a80a15e4dbd9191e1c3c3faf804c60d614a844d9a7f7472c3c1816e9bf2dc81a

Analysis

max time kernel
28s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
13-12-2022 09:49

Target

NewInvoice/NewRules.dll
Size

733KB
MD5

1b4eb3e5510b5f32c4ed5f9ba11288bd
SHA1

f91052aa0a9375422ee29a7756df4756fb759486
SHA256

678b2d1d0e5dc0e18f5f85abbed3d036c99fa9db8704676adaf9ec304b582523
SHA512

40f479618f6f8cc103cb2acb0890ef0833263a501a8a60f2c50eba5602540bd98c7c142eb01355962e5b8bad6d34bb42f31b11aa3f1d950bf2a3c2f82b7e6960
SSDEEP

12288:bx5BlbjoVPn84C8oSZTkwvFsaLJ5sU4gzplUWQnLI7QAeh+nqb7/ODsrETSeWBE:b/CP1jVtkBKzsU4gLUWZ7tqb72eR

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1188 1808 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1188	1808	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1400 wrote to memory of 1808	1400	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 1808	1400	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 1808	1400	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 1808	1400	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 1808	1400	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 1808	1400	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 1808	1400	rundll32.exe	rundll32.exe
PID 1808 wrote to memory of 1188	1808	rundll32.exe	WerFault.exe
PID 1808 wrote to memory of 1188	1808	rundll32.exe	WerFault.exe
PID 1808 wrote to memory of 1188	1808	rundll32.exe	WerFault.exe
PID 1808 wrote to memory of 1188	1808	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NewInvoice\NewRules.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1400

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NewInvoice\NewRules.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 224
3⤵
- Program crash
PID:1188

memory/1188-56-0x0000000000000000-mapping.dmp

Download
memory/1808-54-0x0000000000000000-mapping.dmp

Download
memory/1808-55-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download