8cda8ebfb06a8df26692325d553f7218d98633d97e6fe9b09c9913281aa06e54

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
22-12-2022 16:35

Target

Invoice/Contract.dll
Size

516KB
MD5

9f6ec22b24f100366d83dfe499e5bd3e
SHA1

bce43420d7bcf48ca3f99707feea8e55d454195b
SHA256

784a2827b5ddc82e69198aa9f6a5382c32716eb0263bc2a4f6fc500589c8a3ef
SHA512

926c3d1b160a8d76075dfa1f4c2eb3447f02fe0fe019c5949ab20c2f2940f2079ff1aa6afafa4cdebedb7783a5004b1a688b43a5cf5b9451146a324fc7e49469
SSDEEP

6144:wiIqnct7uycRpLrFPQleGc2BpeQvfTiD3MJIyFX+OwjzK9y9KOc6rXPMATcBu:wihnctArBgRprvbiIIAuz19nTMAgc

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1232 wrote to memory of 1528	1232	rundll32.exe	rundll32.exe
PID 1232 wrote to memory of 1528	1232	rundll32.exe	rundll32.exe
PID 1232 wrote to memory of 1528	1232	rundll32.exe	rundll32.exe
PID 1232 wrote to memory of 1528	1232	rundll32.exe	rundll32.exe
PID 1232 wrote to memory of 1528	1232	rundll32.exe	rundll32.exe
PID 1232 wrote to memory of 1528	1232	rundll32.exe	rundll32.exe
PID 1232 wrote to memory of 1528	1232	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Invoice\Contract.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1232

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Invoice\Contract.dll,#1
2⤵
PID:1528

memory/1528-54-0x0000000000000000-mapping.dmp

Download
memory/1528-55-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download