0af20bafea6a34fceaba57171fd8d8fed74b3dd1b007503ab12dae115dde7c0d

Analysis

max time kernel
501s
max time network
504s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
13-12-2022 14:45

Target

SCAN_WE2280/YouNewRules/NewInvoice.dll
Size

733KB
MD5

54ecbfa7177bc2e7a8c1a0d0e7ff9189
SHA1

4c38593056d8331294f1f6b2cee3f4550adef8eb
SHA256

9953dc1dfb656c66ec4ca87d371a72a3d413a96610025d59ae3729e5cd232da5
SHA512

97f95e03c4b84cc2778e5227a890abac98f7022714f0eb6b2d280efc8180cee2338fe9fb0d6100642040ae8f488af56eaed59c95db8aac2961867df5bc450587
SSDEEP

12288:bx5BlbjoVPn84C8oSZTkwvFsaLJ5sU4gzplZWQnLI7QAeh+nqb7/ODsrETSeWBE:b/CP1jVtkBKzsU4gLZWZ7tqb72eR

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2388 2688 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2388	2688	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1524 wrote to memory of 2688	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 2688	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 2688	1524	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SCAN_WE2280\YouNewRules\NewInvoice.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1524

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SCAN_WE2280\YouNewRules\NewInvoice.dll,#1
2⤵
PID:2688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 600
3⤵
- Program crash
PID:2388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2688 -ip 2688
1⤵
PID:3088