5b40b8f968e30a704254f31197f7530c59ea26e81de2d32e6678f18d227645f3

Resubmissions

26-12-2022 16:29

26-12-2022 05:20

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26-12-2022 16:29

Target

UpdatedFiles/NewInvoice.dll
Size

817KB
MD5

7f1ec89288b47335f996b50907bc5280
SHA1

dc58e0658fdd33a00e9699acbad6fdeb15daf1c8
SHA256

670cb4fded7498acfb990704b499cba6907bc279341dd7302ac526b715462c9f
SHA512

77b008ac80f995bcb102ddac715724928d56c8dd41bff1c1f0109e3691942637a0a592deb892e5c9d6ab866c1a3b07a91218d85a60496baa132a9ed23ed19f6f
SSDEEP

12288:JJGwvTfCMf8rVomRle7XBr4fi7wDqo4TARMhxMrFND648j4xhT6Tl:JY5rVtcsfi7wDP4TAR0sFN+Ux

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2008 1112 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2008	1112	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2040 wrote to memory of 1112	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 1112	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 1112	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 1112	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 1112	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 1112	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 1112	2040	rundll32.exe	rundll32.exe
PID 1112 wrote to memory of 2008	1112	rundll32.exe	WerFault.exe
PID 1112 wrote to memory of 2008	1112	rundll32.exe	WerFault.exe
PID 1112 wrote to memory of 2008	1112	rundll32.exe	WerFault.exe
PID 1112 wrote to memory of 2008	1112	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\UpdatedFiles\NewInvoice.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\UpdatedFiles\NewInvoice.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 224
3⤵
- Program crash
PID:2008

memory/1112-54-0x0000000000000000-mapping.dmp

Download
memory/1112-55-0x00000000760D1000-0x00000000760D3000-memory.dmp

Filesize
8KB

Download
memory/2008-56-0x0000000000000000-mapping.dmp

Download