8cda8ebfb06a8df26692325d553f7218d98633d97e6fe9b09c9913281aa06e54

Analysis

max time kernel
91s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2022 16:35

Target

Invoice/Contract.dll
Size

516KB
MD5

9f6ec22b24f100366d83dfe499e5bd3e
SHA1

bce43420d7bcf48ca3f99707feea8e55d454195b
SHA256

784a2827b5ddc82e69198aa9f6a5382c32716eb0263bc2a4f6fc500589c8a3ef
SHA512

926c3d1b160a8d76075dfa1f4c2eb3447f02fe0fe019c5949ab20c2f2940f2079ff1aa6afafa4cdebedb7783a5004b1a688b43a5cf5b9451146a324fc7e49469
SSDEEP

6144:wiIqnct7uycRpLrFPQleGc2BpeQvfTiD3MJIyFX+OwjzK9y9KOc6rXPMATcBu:wihnctArBgRprvbiIIAuz19nTMAgc

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4376 2680 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4376	2680	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3544 wrote to memory of 2680	3544	rundll32.exe	rundll32.exe
PID 3544 wrote to memory of 2680	3544	rundll32.exe	rundll32.exe
PID 3544 wrote to memory of 2680	3544	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Invoice\Contract.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3544

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Invoice\Contract.dll,#1
2⤵
PID:2680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 600
3⤵
- Program crash
PID:4376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2680 -ip 2680
1⤵
PID:2456