5b40b8f968e30a704254f31197f7530c59ea26e81de2d32e6678f18d227645f3

Resubmissions

26-12-2022 16:44

26-12-2022 05:21

max time kernel
39s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-12-2022 16:44

Target

UpdatedFiles/NewInvoice.dll
Size

817KB
MD5

7f1ec89288b47335f996b50907bc5280
SHA1

dc58e0658fdd33a00e9699acbad6fdeb15daf1c8
SHA256

670cb4fded7498acfb990704b499cba6907bc279341dd7302ac526b715462c9f
SHA512

77b008ac80f995bcb102ddac715724928d56c8dd41bff1c1f0109e3691942637a0a592deb892e5c9d6ab866c1a3b07a91218d85a60496baa132a9ed23ed19f6f
SSDEEP

12288:JJGwvTfCMf8rVomRle7XBr4fi7wDqo4TARMhxMrFND648j4xhT6Tl:JY5rVtcsfi7wDP4TAR0sFN+Ux

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

940 1364 WerFault.exe rundll32.exe

pid	pid_target	process	target process
940	1364	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 904 wrote to memory of 1364	904	rundll32.exe	rundll32.exe
PID 904 wrote to memory of 1364	904	rundll32.exe	rundll32.exe
PID 904 wrote to memory of 1364	904	rundll32.exe	rundll32.exe
PID 904 wrote to memory of 1364	904	rundll32.exe	rundll32.exe
PID 904 wrote to memory of 1364	904	rundll32.exe	rundll32.exe
PID 904 wrote to memory of 1364	904	rundll32.exe	rundll32.exe
PID 904 wrote to memory of 1364	904	rundll32.exe	rundll32.exe
PID 1364 wrote to memory of 940	1364	rundll32.exe	WerFault.exe
PID 1364 wrote to memory of 940	1364	rundll32.exe	WerFault.exe
PID 1364 wrote to memory of 940	1364	rundll32.exe	WerFault.exe
PID 1364 wrote to memory of 940	1364	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\UpdatedFiles\NewInvoice.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:904

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\UpdatedFiles\NewInvoice.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 224
3⤵
- Program crash
PID:940

memory/940-56-0x0000000000000000-mapping.dmp

Download
memory/1364-54-0x0000000000000000-mapping.dmp

Download
memory/1364-55-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download